diff --git a/4.x/_gen/data/bigquery_dataset.libsonnet b/4.x/_gen/data/bigquery_dataset.libsonnet
new file mode 100644
index 00000000..8c9011bb
--- /dev/null
+++ b/4.x/_gen/data/bigquery_dataset.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='bigquery_dataset', url='', help='`bigquery_dataset` represents the `google_bigquery_dataset` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.bigquery_dataset.new` injects a new `data_google_bigquery_dataset` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.bigquery_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.bigquery_dataset` using the reference:\n\n    $._ref.data_google_bigquery_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_bigquery_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    dataset_id,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_bigquery_dataset',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(dataset_id=dataset_id, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`\nTerraform data source.\n\nUnlike [google.data.bigquery_dataset.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `bigquery_dataset` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    dataset_id,
+    project=null
+  ):: std.prune(a={
+    dataset_id: dataset_id,
+    project: project,
+  }),
+  '#withDatasetId':: d.fn(help='`google.string.withDatasetId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the dataset_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `dataset_id` field.\n', args=[]),
+  withDatasetId(dataSrcLabel, value): {
+    data+: {
+      google_bigquery_dataset+: {
+        [dataSrcLabel]+: {
+          dataset_id: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_bigquery_dataset+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloud_identity_group_lookup.libsonnet b/4.x/_gen/data/cloud_identity_group_lookup.libsonnet
new file mode 100644
index 00000000..9a8f9302
--- /dev/null
+++ b/4.x/_gen/data/cloud_identity_group_lookup.libsonnet
@@ -0,0 +1,50 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='cloud_identity_group_lookup', url='', help='`cloud_identity_group_lookup` represents the `google_cloud_identity_group_lookup` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  group_key:: {
+    '#new':: d.fn(help='\n`google.cloud_identity_group_lookup.group_key.new` constructs a new object with attributes and blocks configured for the `group_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `namespace` (`string`): The namespace in which the entity exists. If not specified, the EntityKey represents a Google-managed entity such as a Google user or a Google Group.\nIf specified, the EntityKey represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of identitysources/{identity_source}. When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `group_key` sub block.\n', args=[]),
+    new(
+      namespace=null
+    ):: std.prune(a={
+      namespace: namespace,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.data.cloud_identity_group_lookup.new` injects a new `data_google_cloud_identity_group_lookup` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloud_identity_group_lookup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloud_identity_group_lookup` using the reference:\n\n    $._ref.data_google_cloud_identity_group_lookup.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloud_identity_group_lookup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.\nAn entity can represent either a group with an optional namespace or a user without a namespace.\nThe combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    group_key=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_cloud_identity_group_lookup',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(group_key=group_key),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.cloud_identity_group_lookup.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_identity_group_lookup`\nTerraform data source.\n\nUnlike [google.data.cloud_identity_group_lookup.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.\nAn entity can represent either a group with an optional namespace or a user without a namespace.\nThe combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_identity_group_lookup` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    group_key=null
+  ):: std.prune(a={
+    group_key: group_key,
+  }),
+  '#withGroupKey':: d.fn(help='`google.list[obj].withGroupKey` constructs a mixin object that can be merged into the `list[obj]`\nTerraform data source block to set or update the group_key field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGroupKeyMixin](TODO) function.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `group_key` field.\n', args=[]),
+  withGroupKey(dataSrcLabel, value): {
+    data+: {
+      google_cloud_identity_group_lookup+: {
+        [dataSrcLabel]+: {
+          group_key: value,
+        },
+      },
+    },
+  },
+  '#withGroupKeyMixin':: d.fn(help='`google.list[obj].withGroupKeyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform data source block to set or update the group_key field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGroupKey](TODO)\nfunction.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `group_key` field.\n', args=[]),
+  withGroupKeyMixin(dataSrcLabel, value): {
+    data+: {
+      google_cloud_identity_group_lookup+: {
+        [dataSrcLabel]+: {
+          group_key+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloud_run_v2_job.libsonnet b/4.x/_gen/data/cloud_run_v2_job.libsonnet
new file mode 100644
index 00000000..6ef3b91c
--- /dev/null
+++ b/4.x/_gen/data/cloud_run_v2_job.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='cloud_run_v2_job', url='', help='`cloud_run_v2_job` represents the `google_cloud_run_v2_job` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.cloud_run_v2_job.new` injects a new `data_google_cloud_run_v2_job` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloud_run_v2_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloud_run_v2_job` using the reference:\n\n    $._ref.data_google_cloud_run_v2_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloud_run_v2_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_cloud_run_v2_job',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`\nTerraform data source.\n\nUnlike [google.data.cloud_run_v2_job.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_job` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_job+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_job+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_job+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloud_run_v2_service.libsonnet b/4.x/_gen/data/cloud_run_v2_service.libsonnet
new file mode 100644
index 00000000..1a6388ca
--- /dev/null
+++ b/4.x/_gen/data/cloud_run_v2_service.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='cloud_run_v2_service', url='', help='`cloud_run_v2_service` represents the `google_cloud_run_v2_service` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.cloud_run_v2_service.new` injects a new `data_google_cloud_run_v2_service` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloud_run_v2_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloud_run_v2_service` using the reference:\n\n    $._ref.data_google_cloud_run_v2_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloud_run_v2_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_cloud_run_v2_service',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`\nTerraform data source.\n\nUnlike [google.data.cloud_run_v2_service.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_service` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_service+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_service+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_service+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloudiot_registry_iam_policy.libsonnet b/4.x/_gen/data/cloudiot_registry_iam_policy.libsonnet
deleted file mode 100644
index de607446..00000000
--- a/4.x/_gen/data/cloudiot_registry_iam_policy.libsonnet
+++ /dev/null
@@ -1,58 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_policy', url='', help='`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.cloudiot_registry_iam_policy.new` injects a new `data_google_cloudiot_registry_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloudiot_registry_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloudiot_registry_iam_policy` using the reference:\n\n    $._ref.data_google_cloudiot_registry_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloudiot_registry_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): Set the `name` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting data source block. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
-  new(
-    dataSrcLabel,
-    name,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withData(
-    type='google_cloudiot_registry_iam_policy',
-    label=dataSrcLabel,
-    attrs=self.newAttrs(name=name, project=project, region=region),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.data.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`\nTerraform data source.\n\nUnlike [google.data.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloudiot_registry_iam_policy` data source into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    name: name,
-    project: project,
-    region: region,
-  }),
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(dataSrcLabel, value): {
-    data+: {
-      google_cloudiot_registry_iam_policy+: {
-        [dataSrcLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(dataSrcLabel, value): {
-    data+: {
-      google_cloudiot_registry_iam_policy+: {
-        [dataSrcLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the region field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(dataSrcLabel, value): {
-    data+: {
-      google_cloudiot_registry_iam_policy+: {
-        [dataSrcLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/data/compute_machine_types.libsonnet b/4.x/_gen/data/compute_machine_types.libsonnet
new file mode 100644
index 00000000..3007f9c8
--- /dev/null
+++ b/4.x/_gen/data/compute_machine_types.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='compute_machine_types', url='', help='`compute_machine_types` represents the `google_compute_machine_types` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.compute_machine_types.new` injects a new `data_google_compute_machine_types` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_machine_types.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_machine_types` using the reference:\n\n    $._ref.data_google_compute_machine_types.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_machine_types.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `filter` (`string`): Set the `filter` field on the resulting data source block. When `null`, the `filter` field will be omitted from the resulting object.\n  - `project` (`string`): Project ID for this request. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): The name of the zone for this request. When `null`, the `zone` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    filter=null,
+    project=null,
+    zone=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_compute_machine_types',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(filter=filter, project=project, zone=zone),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.compute_machine_types.newAttrs` constructs a new object with attributes and blocks configured for the `compute_machine_types`\nTerraform data source.\n\nUnlike [google.data.compute_machine_types.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `filter` (`string`): Set the `filter` field on the resulting object. When `null`, the `filter` field will be omitted from the resulting object.\n  - `project` (`string`): Project ID for this request. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): The name of the zone for this request. When `null`, the `zone` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_machine_types` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    filter=null,
+    project=null,
+    zone=null
+  ):: std.prune(a={
+    filter: filter,
+    project: project,
+    zone: zone,
+  }),
+  '#withFilter':: d.fn(help='`google.string.withFilter` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the filter field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `filter` field.\n', args=[]),
+  withFilter(dataSrcLabel, value): {
+    data+: {
+      google_compute_machine_types+: {
+        [dataSrcLabel]+: {
+          filter: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_compute_machine_types+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withZone':: d.fn(help='`google.string.withZone` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the zone field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `zone` field.\n', args=[]),
+  withZone(dataSrcLabel, value): {
+    data+: {
+      google_compute_machine_types+: {
+        [dataSrcLabel]+: {
+          zone: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/compute_networks.libsonnet b/4.x/_gen/data/compute_networks.libsonnet
new file mode 100644
index 00000000..9a9c2a36
--- /dev/null
+++ b/4.x/_gen/data/compute_networks.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='compute_networks', url='', help='`compute_networks` represents the `google_compute_networks` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.compute_networks.new` injects a new `data_google_compute_networks` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_networks.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_networks` using the reference:\n\n    $._ref.data_google_compute_networks.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_networks.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_compute_networks',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.compute_networks.newAttrs` constructs a new object with attributes and blocks configured for the `compute_networks`\nTerraform data source.\n\nUnlike [google.data.compute_networks.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_networks` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    project=null
+  ):: std.prune(a={
+    project: project,
+  }),
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_compute_networks+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/compute_region_disk.libsonnet b/4.x/_gen/data/compute_region_disk.libsonnet
new file mode 100644
index 00000000..f1677b17
--- /dev/null
+++ b/4.x/_gen/data/compute_region_disk.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='compute_region_disk', url='', help='`compute_region_disk` represents the `google_compute_region_disk` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.compute_region_disk.new` injects a new `data_google_compute_region_disk` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_region_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_region_disk` using the reference:\n\n    $._ref.data_google_compute_region_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_region_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    project=null,
+    region=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_compute_region_disk',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, project=project, region=region),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.compute_region_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_disk`\nTerraform data source.\n\nUnlike [google.data.compute_region_disk.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_region_disk` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    project=null,
+    region=null
+  ):: std.prune(a={
+    name: name,
+    project: project,
+    region: region,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_compute_region_disk+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_compute_region_disk+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the region field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(dataSrcLabel, value): {
+    data+: {
+      google_compute_region_disk+: {
+        [dataSrcLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/compute_region_network_endpoint_group.libsonnet b/4.x/_gen/data/compute_region_network_endpoint_group.libsonnet
index 29293f1b..f2e9351e 100644
--- a/4.x/_gen/data/compute_region_network_endpoint_group.libsonnet
+++ b/4.x/_gen/data/compute_region_network_endpoint_group.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_region_network_endpoint_group', url='', help='`compute_region_network_endpoint_group` represents the `google_compute_region_network_endpoint_group` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.compute_region_network_endpoint_group.new` injects a new `data_google_compute_region_network_endpoint_group` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_region_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_region_network_endpoint_group` using the reference:\n\n    $._ref.data_google_compute_region_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_region_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the Serverless NEGs Reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `self_link` (`string`): Set the `self_link` field on the resulting data source block. When `null`, the `self_link` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data.compute_region_network_endpoint_group.new` injects a new `data_google_compute_region_network_endpoint_group` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_region_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_region_network_endpoint_group` using the reference:\n\n    $._ref.data_google_compute_region_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_region_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional NEGs reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `self_link` (`string`): Set the `self_link` field on the resulting data source block. When `null`, the `self_link` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
   new(
     dataSrcLabel,
     name=null,
@@ -21,7 +21,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data.compute_region_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_endpoint_group`\nTerraform data source.\n\nUnlike [google.data.compute_region_network_endpoint_group.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the Serverless NEGs Reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `self_link` (`string`): Set the `self_link` field on the resulting object. When `null`, the `self_link` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_region_network_endpoint_group` data source into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data.compute_region_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_endpoint_group`\nTerraform data source.\n\nUnlike [google.data.compute_region_network_endpoint_group.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional NEGs reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `self_link` (`string`): Set the `self_link` field on the resulting object. When `null`, the `self_link` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_region_network_endpoint_group` data source into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name=null,
     project=null,
diff --git a/4.x/_gen/data/compute_reservation.libsonnet b/4.x/_gen/data/compute_reservation.libsonnet
new file mode 100644
index 00000000..8ce7eb44
--- /dev/null
+++ b/4.x/_gen/data/compute_reservation.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='compute_reservation', url='', help='`compute_reservation` represents the `google_compute_reservation` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.compute_reservation.new` injects a new `data_google_compute_reservation` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_reservation.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_reservation` using the reference:\n\n    $._ref.data_google_compute_reservation.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_reservation.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone where the reservation is made.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    zone,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_compute_reservation',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, project=project, zone=zone),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.compute_reservation.newAttrs` constructs a new object with attributes and blocks configured for the `compute_reservation`\nTerraform data source.\n\nUnlike [google.data.compute_reservation.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone where the reservation is made.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_reservation` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    zone,
+    project=null
+  ):: std.prune(a={
+    name: name,
+    project: project,
+    zone: zone,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_compute_reservation+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_compute_reservation+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withZone':: d.fn(help='`google.string.withZone` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the zone field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `zone` field.\n', args=[]),
+  withZone(dataSrcLabel, value): {
+    data+: {
+      google_compute_reservation+: {
+        [dataSrcLabel]+: {
+          zone: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/dns_managed_zones.libsonnet b/4.x/_gen/data/dns_managed_zones.libsonnet
new file mode 100644
index 00000000..7d7cebcf
--- /dev/null
+++ b/4.x/_gen/data/dns_managed_zones.libsonnet
@@ -0,0 +1,61 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='dns_managed_zones', url='', help='`dns_managed_zones` represents the `google_dns_managed_zones` Terraform data source.\n\nProvides access to all zones for a given project within Google Cloud DNS\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  managed_zones:: {
+    '#new':: d.fn(help='\n`google.dns_managed_zones.managed_zones.new` constructs a new object with attributes and blocks configured for the `managed_zones`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `managed_zones` sub block.\n', args=[]),
+    new(
+
+    ):: std.prune(a={}),
+  },
+  '#new':: d.fn(help="\n`google.data.dns_managed_zones.new` injects a new `data_google_dns_managed_zones` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.dns_managed_zones.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.dns_managed_zones` using the reference:\n\n    $._ref.data_google_dns_managed_zones.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_dns_managed_zones.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `project` (`string`): The ID of the project for the Google Cloud. When `null`, the `project` field will be omitted from the resulting object.\n  - `managed_zones` (`list[obj]`): The list of managed zones in the given project. When `null`, the `managed_zones` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.dns_managed_zones.managed_zones.new](#fn-managed_zonesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    managed_zones=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_dns_managed_zones',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(managed_zones=managed_zones, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.dns_managed_zones.newAttrs` constructs a new object with attributes and blocks configured for the `dns_managed_zones`\nTerraform data source.\n\nUnlike [google.data.dns_managed_zones.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `project` (`string`): The ID of the project for the Google Cloud. When `null`, the `project` field will be omitted from the resulting object.\n  - `managed_zones` (`list[obj]`): The list of managed zones in the given project. When `null`, the `managed_zones` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.dns_managed_zones.managed_zones.new](#fn-managed_zonesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `dns_managed_zones` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    managed_zones=null,
+    project=null
+  ):: std.prune(a={
+    managed_zones: managed_zones,
+    project: project,
+  }),
+  '#withManagedZones':: d.fn(help='`google.list[obj].withManagedZones` constructs a mixin object that can be merged into the `list[obj]`\nTerraform data source block to set or update the managed_zones field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withManagedZonesMixin](TODO) function.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `managed_zones` field.\n', args=[]),
+  withManagedZones(dataSrcLabel, value): {
+    data+: {
+      google_dns_managed_zones+: {
+        [dataSrcLabel]+: {
+          managed_zones: value,
+        },
+      },
+    },
+  },
+  '#withManagedZonesMixin':: d.fn(help='`google.list[obj].withManagedZonesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform data source block to set or update the managed_zones field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withManagedZones](TODO)\nfunction.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `managed_zones` field.\n', args=[]),
+  withManagedZonesMixin(dataSrcLabel, value): {
+    data+: {
+      google_dns_managed_zones+: {
+        [dataSrcLabel]+: {
+          managed_zones+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_dns_managed_zones+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/filestore_instance.libsonnet b/4.x/_gen/data/filestore_instance.libsonnet
new file mode 100644
index 00000000..18bf8974
--- /dev/null
+++ b/4.x/_gen/data/filestore_instance.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='filestore_instance', url='', help='`filestore_instance` represents the `google_filestore_instance` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.filestore_instance.new` injects a new `data_google_filestore_instance` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.filestore_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.filestore_instance` using the reference:\n\n    $._ref.data_google_filestore_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_filestore_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_filestore_instance',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.filestore_instance.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_instance`\nTerraform data source.\n\nUnlike [google.data.filestore_instance.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `filestore_instance` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_filestore_instance+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_filestore_instance+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_filestore_instance+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/game_services_game_server_deployment_rollout.libsonnet b/4.x/_gen/data/game_services_game_server_deployment_rollout.libsonnet
deleted file mode 100644
index 30415dc4..00000000
--- a/4.x/_gen/data/game_services_game_server_deployment_rollout.libsonnet
+++ /dev/null
@@ -1,32 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_deployment_rollout', url='', help='`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.game_services_game_server_deployment_rollout.new` injects a new `data_google_game_services_game_server_deployment_rollout` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.game_services_game_server_deployment_rollout.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.game_services_game_server_deployment_rollout` using the reference:\n\n    $._ref.data_google_game_services_game_server_deployment_rollout.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_game_services_game_server_deployment_rollout.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
-  new(
-    dataSrcLabel,
-    deployment_id,
-    _meta={}
-  ):: tf.withData(
-    type='google_game_services_game_server_deployment_rollout',
-    label=dataSrcLabel,
-    attrs=self.newAttrs(deployment_id=deployment_id),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.data.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`\nTerraform data source.\n\nUnlike [google.data.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `game_services_game_server_deployment_rollout` data source into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    deployment_id
-  ):: std.prune(a={
-    deployment_id: deployment_id,
-  }),
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(dataSrcLabel, value): {
-    data+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [dataSrcLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet b/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet
index 9fb5e4b7..3f4abd29 100644
--- a/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet
+++ b/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet
@@ -2,26 +2,39 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_membership_iam_policy', url='', help='`gke_hub_membership_iam_policy` represents the `google_gke_hub_membership_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.gke_hub_membership_iam_policy.new` injects a new `data_google_gke_hub_membership_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.data_google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data.gke_hub_membership_iam_policy.new` injects a new `data_google_gke_hub_membership_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.data_google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
   new(
     dataSrcLabel,
     membership_id,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withData(
     type='google_gke_hub_membership_iam_policy',
     label=dataSrcLabel,
-    attrs=self.newAttrs(membership_id=membership_id, project=project),
+    attrs=self.newAttrs(location=location, membership_id=membership_id, project=project),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform data source.\n\nUnlike [google.data.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `gke_hub_membership_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform data source.\n\nUnlike [google.data.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `gke_hub_membership_iam_policy` data source into the root Terraform configuration.\n', args=[]),
   newAttrs(
     membership_id,
+    location=null,
     project=null
   ):: std.prune(a={
+    location: location,
     membership_id: membership_id,
     project: project,
   }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_gke_hub_membership_iam_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembershipId':: d.fn(help='`google.string.withMembershipId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the membership_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_id` field.\n', args=[]),
   withMembershipId(dataSrcLabel, value): {
     data+: {
diff --git a/4.x/_gen/data/logging_folder_settings.libsonnet b/4.x/_gen/data/logging_folder_settings.libsonnet
new file mode 100644
index 00000000..8d1566e0
--- /dev/null
+++ b/4.x/_gen/data/logging_folder_settings.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='logging_folder_settings', url='', help='`logging_folder_settings` represents the `google_logging_folder_settings` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.logging_folder_settings.new` injects a new `data_google_logging_folder_settings` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.logging_folder_settings.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.logging_folder_settings` using the reference:\n\n    $._ref.data_google_logging_folder_settings.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_logging_folder_settings.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `folder` (`string`): The folder for which to retrieve settings.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    folder,
+    _meta={}
+  ):: tf.withData(
+    type='google_logging_folder_settings',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(folder=folder),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.logging_folder_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_folder_settings`\nTerraform data source.\n\nUnlike [google.data.logging_folder_settings.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `folder` (`string`): The folder for which to retrieve settings.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `logging_folder_settings` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    folder
+  ):: std.prune(a={
+    folder: folder,
+  }),
+  '#withFolder':: d.fn(help='`google.string.withFolder` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the folder field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `folder` field.\n', args=[]),
+  withFolder(dataSrcLabel, value): {
+    data+: {
+      google_logging_folder_settings+: {
+        [dataSrcLabel]+: {
+          folder: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/logging_organization_settings.libsonnet b/4.x/_gen/data/logging_organization_settings.libsonnet
new file mode 100644
index 00000000..b8ed750d
--- /dev/null
+++ b/4.x/_gen/data/logging_organization_settings.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='logging_organization_settings', url='', help='`logging_organization_settings` represents the `google_logging_organization_settings` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.logging_organization_settings.new` injects a new `data_google_logging_organization_settings` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.logging_organization_settings.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.logging_organization_settings` using the reference:\n\n    $._ref.data_google_logging_organization_settings.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_logging_organization_settings.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `organization` (`string`): The organization for which to retrieve settings.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    organization,
+    _meta={}
+  ):: tf.withData(
+    type='google_logging_organization_settings',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(organization=organization),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.logging_organization_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_organization_settings`\nTerraform data source.\n\nUnlike [google.data.logging_organization_settings.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `organization` (`string`): The organization for which to retrieve settings.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `logging_organization_settings` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    organization
+  ):: std.prune(a={
+    organization: organization,
+  }),
+  '#withOrganization':: d.fn(help='`google.string.withOrganization` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the organization field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `organization` field.\n', args=[]),
+  withOrganization(dataSrcLabel, value): {
+    data+: {
+      google_logging_organization_settings+: {
+        [dataSrcLabel]+: {
+          organization: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/logging_project_settings.libsonnet b/4.x/_gen/data/logging_project_settings.libsonnet
new file mode 100644
index 00000000..def44601
--- /dev/null
+++ b/4.x/_gen/data/logging_project_settings.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='logging_project_settings', url='', help='`logging_project_settings` represents the `google_logging_project_settings` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.logging_project_settings.new` injects a new `data_google_logging_project_settings` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.logging_project_settings.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.logging_project_settings` using the reference:\n\n    $._ref.data_google_logging_project_settings.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_logging_project_settings.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `project` (`string`): The project for which to retrieve settings.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    project,
+    _meta={}
+  ):: tf.withData(
+    type='google_logging_project_settings',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.logging_project_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_settings`\nTerraform data source.\n\nUnlike [google.data.logging_project_settings.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `project` (`string`): The project for which to retrieve settings.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `logging_project_settings` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    project
+  ):: std.prune(a={
+    project: project,
+  }),
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_logging_project_settings+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/main.libsonnet b/4.x/_gen/data/main.libsonnet
index 677f8722..60e5e7e1 100644
--- a/4.x/_gen/data/main.libsonnet
+++ b/4.x/_gen/data/main.libsonnet
@@ -19,6 +19,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   bigquery_analytics_hub_listing_iam_policy: (import 'bigquery_analytics_hub_listing_iam_policy.libsonnet'),
   bigquery_connection_iam_policy: (import 'bigquery_connection_iam_policy.libsonnet'),
   bigquery_datapolicy_data_policy_iam_policy: (import 'bigquery_datapolicy_data_policy_iam_policy.libsonnet'),
+  bigquery_dataset: (import 'bigquery_dataset.libsonnet'),
   bigquery_dataset_iam_policy: (import 'bigquery_dataset_iam_policy.libsonnet'),
   bigquery_default_service_account: (import 'bigquery_default_service_account.libsonnet'),
   bigquery_table_iam_policy: (import 'bigquery_table_iam_policy.libsonnet'),
@@ -30,12 +31,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   certificate_manager_certificate_map: (import 'certificate_manager_certificate_map.libsonnet'),
   client_config: (import 'client_config.libsonnet'),
   client_openid_userinfo: (import 'client_openid_userinfo.libsonnet'),
+  cloud_identity_group_lookup: (import 'cloud_identity_group_lookup.libsonnet'),
   cloud_identity_group_memberships: (import 'cloud_identity_group_memberships.libsonnet'),
   cloud_identity_groups: (import 'cloud_identity_groups.libsonnet'),
   cloud_run_locations: (import 'cloud_run_locations.libsonnet'),
   cloud_run_service: (import 'cloud_run_service.libsonnet'),
   cloud_run_service_iam_policy: (import 'cloud_run_service_iam_policy.libsonnet'),
+  cloud_run_v2_job: (import 'cloud_run_v2_job.libsonnet'),
   cloud_run_v2_job_iam_policy: (import 'cloud_run_v2_job_iam_policy.libsonnet'),
+  cloud_run_v2_service: (import 'cloud_run_v2_service.libsonnet'),
   cloud_run_v2_service_iam_policy: (import 'cloud_run_v2_service_iam_policy.libsonnet'),
   cloud_tasks_queue_iam_policy: (import 'cloud_tasks_queue_iam_policy.libsonnet'),
   cloudbuild_trigger: (import 'cloudbuild_trigger.libsonnet'),
@@ -44,7 +48,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   cloudfunctions2_function_iam_policy: (import 'cloudfunctions2_function_iam_policy.libsonnet'),
   cloudfunctions_function: (import 'cloudfunctions_function.libsonnet'),
   cloudfunctions_function_iam_policy: (import 'cloudfunctions_function_iam_policy.libsonnet'),
-  cloudiot_registry_iam_policy: (import 'cloudiot_registry_iam_policy.libsonnet'),
   composer_environment: (import 'composer_environment.libsonnet'),
   composer_image_versions: (import 'composer_image_versions.libsonnet'),
   compute_address: (import 'compute_address.libsonnet'),
@@ -68,16 +71,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   compute_instance_serial_port: (import 'compute_instance_serial_port.libsonnet'),
   compute_instance_template: (import 'compute_instance_template.libsonnet'),
   compute_lb_ip_ranges: (import 'compute_lb_ip_ranges.libsonnet'),
+  compute_machine_types: (import 'compute_machine_types.libsonnet'),
   compute_network: (import 'compute_network.libsonnet'),
   compute_network_endpoint_group: (import 'compute_network_endpoint_group.libsonnet'),
   compute_network_peering: (import 'compute_network_peering.libsonnet'),
+  compute_networks: (import 'compute_networks.libsonnet'),
   compute_node_types: (import 'compute_node_types.libsonnet'),
+  compute_region_disk: (import 'compute_region_disk.libsonnet'),
   compute_region_disk_iam_policy: (import 'compute_region_disk_iam_policy.libsonnet'),
   compute_region_instance_group: (import 'compute_region_instance_group.libsonnet'),
   compute_region_instance_template: (import 'compute_region_instance_template.libsonnet'),
   compute_region_network_endpoint_group: (import 'compute_region_network_endpoint_group.libsonnet'),
   compute_region_ssl_certificate: (import 'compute_region_ssl_certificate.libsonnet'),
   compute_regions: (import 'compute_regions.libsonnet'),
+  compute_reservation: (import 'compute_reservation.libsonnet'),
   compute_resource_policy: (import 'compute_resource_policy.libsonnet'),
   compute_router: (import 'compute_router.libsonnet'),
   compute_router_nat: (import 'compute_router_nat.libsonnet'),
@@ -118,14 +125,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   dns_keys: (import 'dns_keys.libsonnet'),
   dns_managed_zone: (import 'dns_managed_zone.libsonnet'),
   dns_managed_zone_iam_policy: (import 'dns_managed_zone_iam_policy.libsonnet'),
+  dns_managed_zones: (import 'dns_managed_zones.libsonnet'),
   dns_record_set: (import 'dns_record_set.libsonnet'),
   endpoints_service_consumers_iam_policy: (import 'endpoints_service_consumers_iam_policy.libsonnet'),
   endpoints_service_iam_policy: (import 'endpoints_service_iam_policy.libsonnet'),
+  filestore_instance: (import 'filestore_instance.libsonnet'),
   folder: (import 'folder.libsonnet'),
   folder_iam_policy: (import 'folder_iam_policy.libsonnet'),
   folder_organization_policy: (import 'folder_organization_policy.libsonnet'),
   folders: (import 'folders.libsonnet'),
-  game_services_game_server_deployment_rollout: (import 'game_services_game_server_deployment_rollout.libsonnet'),
   gke_backup_backup_plan_iam_policy: (import 'gke_backup_backup_plan_iam_policy.libsonnet'),
   gke_backup_restore_plan_iam_policy: (import 'gke_backup_restore_plan_iam_policy.libsonnet'),
   gke_hub_feature_iam_policy: (import 'gke_hub_feature_iam_policy.libsonnet'),
@@ -156,7 +164,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   kms_key_ring_iam_policy: (import 'kms_key_ring_iam_policy.libsonnet'),
   kms_secret: (import 'kms_secret.libsonnet'),
   kms_secret_ciphertext: (import 'kms_secret_ciphertext.libsonnet'),
+  logging_folder_settings: (import 'logging_folder_settings.libsonnet'),
+  logging_organization_settings: (import 'logging_organization_settings.libsonnet'),
   logging_project_cmek_settings: (import 'logging_project_cmek_settings.libsonnet'),
+  logging_project_settings: (import 'logging_project_settings.libsonnet'),
   logging_sink: (import 'logging_sink.libsonnet'),
   monitoring_app_engine_service: (import 'monitoring_app_engine_service.libsonnet'),
   monitoring_cluster_istio_service: (import 'monitoring_cluster_istio_service.libsonnet'),
@@ -165,6 +176,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   monitoring_notification_channel: (import 'monitoring_notification_channel.libsonnet'),
   monitoring_uptime_check_ips: (import 'monitoring_uptime_check_ips.libsonnet'),
   netblock_ip_ranges: (import 'netblock_ip_ranges.libsonnet'),
+  network_security_address_group_iam_policy: (import 'network_security_address_group_iam_policy.libsonnet'),
   notebooks_instance_iam_policy: (import 'notebooks_instance_iam_policy.libsonnet'),
   notebooks_runtime_iam_policy: (import 'notebooks_runtime_iam_policy.libsonnet'),
   organization: (import 'organization.libsonnet'),
@@ -177,6 +189,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   project_organization_policy: (import 'project_organization_policy.libsonnet'),
   project_service: (import 'project_service.libsonnet'),
   projects: (import 'projects.libsonnet'),
+  pubsub_schema_iam_policy: (import 'pubsub_schema_iam_policy.libsonnet'),
   pubsub_subscription: (import 'pubsub_subscription.libsonnet'),
   pubsub_subscription_iam_policy: (import 'pubsub_subscription_iam_policy.libsonnet'),
   pubsub_topic: (import 'pubsub_topic.libsonnet'),
@@ -187,6 +200,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   secret_manager_secret_iam_policy: (import 'secret_manager_secret_iam_policy.libsonnet'),
   secret_manager_secret_version: (import 'secret_manager_secret_version.libsonnet'),
   secret_manager_secret_version_access: (import 'secret_manager_secret_version_access.libsonnet'),
+  secret_manager_secrets: (import 'secret_manager_secrets.libsonnet'),
+  secure_source_manager_instance_iam_policy: (import 'secure_source_manager_instance_iam_policy.libsonnet'),
   service_account: (import 'service_account.libsonnet'),
   service_account_access_token: (import 'service_account_access_token.libsonnet'),
   service_account_iam_policy: (import 'service_account_iam_policy.libsonnet'),
@@ -220,5 +235,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   tags_tag_value_iam_policy: (import 'tags_tag_value_iam_policy.libsonnet'),
   tpu_tensorflow_versions: (import 'tpu_tensorflow_versions.libsonnet'),
   vertex_ai_index: (import 'vertex_ai_index.libsonnet'),
+  vmwareengine_cluster: (import 'vmwareengine_cluster.libsonnet'),
+  vmwareengine_external_access_rule: (import 'vmwareengine_external_access_rule.libsonnet'),
+  vmwareengine_external_address: (import 'vmwareengine_external_address.libsonnet'),
+  vmwareengine_network: (import 'vmwareengine_network.libsonnet'),
+  vmwareengine_network_peering: (import 'vmwareengine_network_peering.libsonnet'),
+  vmwareengine_network_policy: (import 'vmwareengine_network_policy.libsonnet'),
+  vmwareengine_nsx_credentials: (import 'vmwareengine_nsx_credentials.libsonnet'),
+  vmwareengine_private_cloud: (import 'vmwareengine_private_cloud.libsonnet'),
+  vmwareengine_subnet: (import 'vmwareengine_subnet.libsonnet'),
+  vmwareengine_vcenter_credentials: (import 'vmwareengine_vcenter_credentials.libsonnet'),
   vpc_access_connector: (import 'vpc_access_connector.libsonnet'),
+  workbench_instance_iam_policy: (import 'workbench_instance_iam_policy.libsonnet'),
 }
diff --git a/4.x/_gen/data/network_security_address_group_iam_policy.libsonnet b/4.x/_gen/data/network_security_address_group_iam_policy.libsonnet
new file mode 100644
index 00000000..98d3731b
--- /dev/null
+++ b/4.x/_gen/data/network_security_address_group_iam_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='network_security_address_group_iam_policy', url='', help='`network_security_address_group_iam_policy` represents the `google_network_security_address_group_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.network_security_address_group_iam_policy.new` injects a new `data_google_network_security_address_group_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.network_security_address_group_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.network_security_address_group_iam_policy` using the reference:\n\n    $._ref.data_google_network_security_address_group_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_network_security_address_group_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_network_security_address_group_iam_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.network_security_address_group_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_policy`\nTerraform data source.\n\nUnlike [google.data.network_security_address_group_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `network_security_address_group_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_network_security_address_group_iam_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_network_security_address_group_iam_policy+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_network_security_address_group_iam_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/pubsub_schema_iam_policy.libsonnet b/4.x/_gen/data/pubsub_schema_iam_policy.libsonnet
new file mode 100644
index 00000000..b409c206
--- /dev/null
+++ b/4.x/_gen/data/pubsub_schema_iam_policy.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_policy', url='', help='`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.pubsub_schema_iam_policy.new` injects a new `data_google_pubsub_schema_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.pubsub_schema_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.pubsub_schema_iam_policy` using the reference:\n\n    $._ref.data_google_pubsub_schema_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_pubsub_schema_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting data source block.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    schema,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_pubsub_schema_iam_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(project=project, schema=schema),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`\nTerraform data source.\n\nUnlike [google.data.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pubsub_schema_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    schema,
+    project=null
+  ):: std.prune(a={
+    project: project,
+    schema: schema,
+  }),
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_pubsub_schema_iam_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the schema field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(dataSrcLabel, value): {
+    data+: {
+      google_pubsub_schema_iam_policy+: {
+        [dataSrcLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/secret_manager_secrets.libsonnet b/4.x/_gen/data/secret_manager_secrets.libsonnet
new file mode 100644
index 00000000..da291491
--- /dev/null
+++ b/4.x/_gen/data/secret_manager_secrets.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secret_manager_secrets', url='', help='`secret_manager_secrets` represents the `google_secret_manager_secrets` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.secret_manager_secrets.new` injects a new `data_google_secret_manager_secrets` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.secret_manager_secrets.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.secret_manager_secrets` using the reference:\n\n    $._ref.data_google_secret_manager_secrets.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_secret_manager_secrets.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).\nList only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    filter=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_secret_manager_secrets',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(filter=filter, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.secret_manager_secrets.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secrets`\nTerraform data source.\n\nUnlike [google.data.secret_manager_secrets.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).\nList only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `secret_manager_secrets` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    filter=null,
+    project=null
+  ):: std.prune(a={
+    filter: filter,
+    project: project,
+  }),
+  '#withFilter':: d.fn(help='`google.string.withFilter` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the filter field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `filter` field.\n', args=[]),
+  withFilter(dataSrcLabel, value): {
+    data+: {
+      google_secret_manager_secrets+: {
+        [dataSrcLabel]+: {
+          filter: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_secret_manager_secrets+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/secure_source_manager_instance_iam_policy.libsonnet b/4.x/_gen/data/secure_source_manager_instance_iam_policy.libsonnet
new file mode 100644
index 00000000..7c170ee6
--- /dev/null
+++ b/4.x/_gen/data/secure_source_manager_instance_iam_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secure_source_manager_instance_iam_policy', url='', help='`secure_source_manager_instance_iam_policy` represents the `google_secure_source_manager_instance_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.secure_source_manager_instance_iam_policy.new` injects a new `data_google_secure_source_manager_instance_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.secure_source_manager_instance_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.secure_source_manager_instance_iam_policy` using the reference:\n\n    $._ref.data_google_secure_source_manager_instance_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_secure_source_manager_instance_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting data source block.\n  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    instance_id,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_secure_source_manager_instance_iam_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(instance_id=instance_id, location=location, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.secure_source_manager_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_policy`\nTerraform data source.\n\nUnlike [google.data.secure_source_manager_instance_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `secure_source_manager_instance_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    instance_id,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    instance_id: instance_id,
+    location: location,
+    project: project,
+  }),
+  '#withInstanceId':: d.fn(help='`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the instance_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `instance_id` field.\n', args=[]),
+  withInstanceId(dataSrcLabel, value): {
+    data+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [dataSrcLabel]+: {
+          instance_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_cluster.libsonnet b/4.x/_gen/data/vmwareengine_cluster.libsonnet
new file mode 100644
index 00000000..8da32326
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_cluster.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_cluster', url='', help='`vmwareengine_cluster` represents the `google_vmwareengine_cluster` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_cluster.new` injects a new `data_google_vmwareengine_cluster` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_cluster` using the reference:\n\n    $._ref.data_google_vmwareengine_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): The ID of the Cluster.\n  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    parent,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_cluster',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, parent=parent),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_cluster`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_cluster.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): The ID of the Cluster.\n  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_cluster` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    parent
+  ):: std.prune(a={
+    name: name,
+    parent: parent,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_cluster+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the parent field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_cluster+: {
+        [dataSrcLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_external_access_rule.libsonnet b/4.x/_gen/data/vmwareengine_external_access_rule.libsonnet
new file mode 100644
index 00000000..fc2a5b16
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_external_access_rule.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_external_access_rule', url='', help='`vmwareengine_external_access_rule` represents the `google_vmwareengine_external_access_rule` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_external_access_rule.new` injects a new `data_google_vmwareengine_external_access_rule` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_external_access_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_external_access_rule` using the reference:\n\n    $._ref.data_google_vmwareengine_external_access_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_external_access_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): The ID of the external access rule.\n  - `parent` (`string`): The resource name of the network policy.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    parent,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_external_access_rule',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, parent=parent),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_external_access_rule.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_access_rule`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_external_access_rule.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): The ID of the external access rule.\n  - `parent` (`string`): The resource name of the network policy.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_external_access_rule` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    parent
+  ):: std.prune(a={
+    name: name,
+    parent: parent,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_external_access_rule+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the parent field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_external_access_rule+: {
+        [dataSrcLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_external_address.libsonnet b/4.x/_gen/data/vmwareengine_external_address.libsonnet
new file mode 100644
index 00000000..4020ff95
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_external_address.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_external_address', url='', help='`vmwareengine_external_address` represents the `google_vmwareengine_external_address` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_external_address.new` injects a new `data_google_vmwareengine_external_address` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_external_address.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_external_address` using the reference:\n\n    $._ref.data_google_vmwareengine_external_address.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_external_address.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): The ID of the external IP Address.\n  - `parent` (`string`): The resource name of the private cloud to create a new external address in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    parent,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_external_address',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, parent=parent),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_external_address.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_address`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_external_address.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): The ID of the external IP Address.\n  - `parent` (`string`): The resource name of the private cloud to create a new external address in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_external_address` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    parent
+  ):: std.prune(a={
+    name: name,
+    parent: parent,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_external_address+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the parent field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_external_address+: {
+        [dataSrcLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_network.libsonnet b/4.x/_gen/data/vmwareengine_network.libsonnet
new file mode 100644
index 00000000..0594dcf9
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_network.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_network', url='', help='`vmwareengine_network` represents the `google_vmwareengine_network` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_network.new` injects a new `data_google_vmwareengine_network` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_network.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_network` using the reference:\n\n    $._ref.data_google_vmwareengine_network.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_network.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The location where the VMwareEngineNetwork should reside.\n  - `name` (`string`): The ID of the VMwareEngineNetwork.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    location,
+    name,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_network',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_network.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_network.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The location where the VMwareEngineNetwork should reside.\n  - `name` (`string`): The ID of the VMwareEngineNetwork.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_network` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_network_peering.libsonnet b/4.x/_gen/data/vmwareengine_network_peering.libsonnet
new file mode 100644
index 00000000..4e6aca66
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_network_peering.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_network_peering', url='', help='`vmwareengine_network_peering` represents the `google_vmwareengine_network_peering` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_network_peering.new` injects a new `data_google_vmwareengine_network_peering` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_network_peering.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_network_peering` using the reference:\n\n    $._ref.data_google_vmwareengine_network_peering.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_network_peering.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): The ID of the Network Peering.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_network_peering',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_network_peering.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_peering`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_network_peering.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): The ID of the Network Peering.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_network_peering` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    project=null
+  ):: std.prune(a={
+    name: name,
+    project: project,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network_peering+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network_peering+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_network_policy.libsonnet b/4.x/_gen/data/vmwareengine_network_policy.libsonnet
new file mode 100644
index 00000000..5367fdab
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_network_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_network_policy', url='', help='`vmwareengine_network_policy` represents the `google_vmwareengine_network_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_network_policy.new` injects a new `data_google_vmwareengine_network_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_network_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_network_policy` using the reference:\n\n    $._ref.data_google_vmwareengine_network_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_network_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The resource name of the location (region) to create the new network policy in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-central1\n  - `name` (`string`): The ID of the Network Policy.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    location,
+    name,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_network_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_network_policy.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_policy`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_network_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The resource name of the location (region) to create the new network policy in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-central1\n  - `name` (`string`): The ID of the Network Policy.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_network_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network_policy+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_network_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_nsx_credentials.libsonnet b/4.x/_gen/data/vmwareengine_nsx_credentials.libsonnet
new file mode 100644
index 00000000..b6297477
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_nsx_credentials.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_nsx_credentials', url='', help='`vmwareengine_nsx_credentials` represents the `google_vmwareengine_nsx_credentials` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_nsx_credentials.new` injects a new `data_google_vmwareengine_nsx_credentials` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_nsx_credentials.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_nsx_credentials` using the reference:\n\n    $._ref.data_google_vmwareengine_nsx_credentials.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_nsx_credentials.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `parent` (`string`): The resource name of the private cloud which contains NSX.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    parent,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_nsx_credentials',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(parent=parent),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_nsx_credentials.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_nsx_credentials`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_nsx_credentials.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `parent` (`string`): The resource name of the private cloud which contains NSX.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_nsx_credentials` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    parent
+  ):: std.prune(a={
+    parent: parent,
+  }),
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the parent field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_nsx_credentials+: {
+        [dataSrcLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_private_cloud.libsonnet b/4.x/_gen/data/vmwareengine_private_cloud.libsonnet
new file mode 100644
index 00000000..5c8ce17f
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_private_cloud.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_private_cloud', url='', help='`vmwareengine_private_cloud` represents the `google_vmwareengine_private_cloud` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_private_cloud.new` injects a new `data_google_vmwareengine_private_cloud` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_private_cloud.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_private_cloud` using the reference:\n\n    $._ref.data_google_vmwareengine_private_cloud.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_private_cloud.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The location where the PrivateCloud should reside.\n  - `name` (`string`): The ID of the PrivateCloud.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    location,
+    name,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_private_cloud',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_private_cloud.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_private_cloud`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_private_cloud.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The location where the PrivateCloud should reside.\n  - `name` (`string`): The ID of the PrivateCloud.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_private_cloud` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_private_cloud+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_private_cloud+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_private_cloud+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_subnet.libsonnet b/4.x/_gen/data/vmwareengine_subnet.libsonnet
new file mode 100644
index 00000000..8c0bdb9d
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_subnet.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_subnet', url='', help='`vmwareengine_subnet` represents the `google_vmwareengine_subnet` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_subnet.new` injects a new `data_google_vmwareengine_subnet` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_subnet.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_subnet` using the reference:\n\n    $._ref.data_google_vmwareengine_subnet.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_subnet.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of \u0026#34;service-n\u0026#34;,\nwhere n ranges from 1 to 5.\n  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    parent,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_subnet',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(name=name, parent=parent),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_subnet.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_subnet`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_subnet.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of "service-n",\nwhere n ranges from 1 to 5.\n  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_subnet` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    parent
+  ):: std.prune(a={
+    name: name,
+    parent: parent,
+  }),
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_subnet+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the parent field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_subnet+: {
+        [dataSrcLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/vmwareengine_vcenter_credentials.libsonnet b/4.x/_gen/data/vmwareengine_vcenter_credentials.libsonnet
new file mode 100644
index 00000000..e9c223da
--- /dev/null
+++ b/4.x/_gen/data/vmwareengine_vcenter_credentials.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_vcenter_credentials', url='', help='`vmwareengine_vcenter_credentials` represents the `google_vmwareengine_vcenter_credentials` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.vmwareengine_vcenter_credentials.new` injects a new `data_google_vmwareengine_vcenter_credentials` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.vmwareengine_vcenter_credentials.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.vmwareengine_vcenter_credentials` using the reference:\n\n    $._ref.data_google_vmwareengine_vcenter_credentials.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_vmwareengine_vcenter_credentials.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `parent` (`string`): The resource name of the private cloud which contains vcenter.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    parent,
+    _meta={}
+  ):: tf.withData(
+    type='google_vmwareengine_vcenter_credentials',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(parent=parent),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.vmwareengine_vcenter_credentials.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_vcenter_credentials`\nTerraform data source.\n\nUnlike [google.data.vmwareengine_vcenter_credentials.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `parent` (`string`): The resource name of the private cloud which contains vcenter.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_vcenter_credentials` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    parent
+  ):: std.prune(a={
+    parent: parent,
+  }),
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the parent field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(dataSrcLabel, value): {
+    data+: {
+      google_vmwareengine_vcenter_credentials+: {
+        [dataSrcLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/workbench_instance_iam_policy.libsonnet b/4.x/_gen/data/workbench_instance_iam_policy.libsonnet
new file mode 100644
index 00000000..ac47fe81
--- /dev/null
+++ b/4.x/_gen/data/workbench_instance_iam_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='workbench_instance_iam_policy', url='', help='`workbench_instance_iam_policy` represents the `google_workbench_instance_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.workbench_instance_iam_policy.new` injects a new `data_google_workbench_instance_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.workbench_instance_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.workbench_instance_iam_policy` using the reference:\n\n    $._ref.data_google_workbench_instance_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_workbench_instance_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_workbench_instance_iam_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.workbench_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_policy`\nTerraform data source.\n\nUnlike [google.data.workbench_instance_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `workbench_instance_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_workbench_instance_iam_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_workbench_instance_iam_policy+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_workbench_instance_iam_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/main.libsonnet b/4.x/_gen/main.libsonnet
index 887418a9..4962df74 100644
--- a/4.x/_gen/main.libsonnet
+++ b/4.x/_gen/main.libsonnet
@@ -23,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   alloydb_backup: (import 'resources/alloydb_backup.libsonnet'),
   alloydb_cluster: (import 'resources/alloydb_cluster.libsonnet'),
   alloydb_instance: (import 'resources/alloydb_instance.libsonnet'),
+  alloydb_user: (import 'resources/alloydb_user.libsonnet'),
   apigee_addons_config: (import 'resources/apigee_addons_config.libsonnet'),
   apigee_endpoint_attachment: (import 'resources/apigee_endpoint_attachment.libsonnet'),
   apigee_env_keystore: (import 'resources/apigee_env_keystore.libsonnet'),
@@ -118,6 +119,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   binary_authorization_attestor_iam_member: (import 'resources/binary_authorization_attestor_iam_member.libsonnet'),
   binary_authorization_attestor_iam_policy: (import 'resources/binary_authorization_attestor_iam_policy.libsonnet'),
   binary_authorization_policy: (import 'resources/binary_authorization_policy.libsonnet'),
+  blockchain_node_engine_blockchain_nodes: (import 'resources/blockchain_node_engine_blockchain_nodes.libsonnet'),
   certificate_manager_certificate: (import 'resources/certificate_manager_certificate.libsonnet'),
   certificate_manager_certificate_issuance_config: (import 'resources/certificate_manager_certificate_issuance_config.libsonnet'),
   certificate_manager_certificate_map: (import 'resources/certificate_manager_certificate_map.libsonnet'),
@@ -158,6 +160,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   cloudbuildv2_repository: (import 'resources/cloudbuildv2_repository.libsonnet'),
   clouddeploy_delivery_pipeline: (import 'resources/clouddeploy_delivery_pipeline.libsonnet'),
   clouddeploy_target: (import 'resources/clouddeploy_target.libsonnet'),
+  clouddomains_registration: (import 'resources/clouddomains_registration.libsonnet'),
   cloudfunctions2_function: (import 'resources/cloudfunctions2_function.libsonnet'),
   cloudfunctions2_function_iam_binding: (import 'resources/cloudfunctions2_function_iam_binding.libsonnet'),
   cloudfunctions2_function_iam_member: (import 'resources/cloudfunctions2_function_iam_member.libsonnet'),
@@ -166,11 +169,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   cloudfunctions_function_iam_binding: (import 'resources/cloudfunctions_function_iam_binding.libsonnet'),
   cloudfunctions_function_iam_member: (import 'resources/cloudfunctions_function_iam_member.libsonnet'),
   cloudfunctions_function_iam_policy: (import 'resources/cloudfunctions_function_iam_policy.libsonnet'),
-  cloudiot_device: (import 'resources/cloudiot_device.libsonnet'),
-  cloudiot_registry: (import 'resources/cloudiot_registry.libsonnet'),
-  cloudiot_registry_iam_binding: (import 'resources/cloudiot_registry_iam_binding.libsonnet'),
-  cloudiot_registry_iam_member: (import 'resources/cloudiot_registry_iam_member.libsonnet'),
-  cloudiot_registry_iam_policy: (import 'resources/cloudiot_registry_iam_policy.libsonnet'),
   composer_environment: (import 'resources/composer_environment.libsonnet'),
   compute_address: (import 'resources/compute_address.libsonnet'),
   compute_attached_disk: (import 'resources/compute_attached_disk.libsonnet'),
@@ -243,6 +241,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   compute_region_health_check: (import 'resources/compute_region_health_check.libsonnet'),
   compute_region_instance_group_manager: (import 'resources/compute_region_instance_group_manager.libsonnet'),
   compute_region_instance_template: (import 'resources/compute_region_instance_template.libsonnet'),
+  compute_region_network_endpoint: (import 'resources/compute_region_network_endpoint.libsonnet'),
   compute_region_network_endpoint_group: (import 'resources/compute_region_network_endpoint_group.libsonnet'),
   compute_region_network_firewall_policy: (import 'resources/compute_region_network_firewall_policy.libsonnet'),
   compute_region_network_firewall_policy_association: (import 'resources/compute_region_network_firewall_policy_association.libsonnet'),
@@ -327,6 +326,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   data_loss_prevention_stored_info_type: (import 'resources/data_loss_prevention_stored_info_type.libsonnet'),
   data_pipeline_pipeline: (import 'resources/data_pipeline_pipeline.libsonnet'),
   database_migration_service_connection_profile: (import 'resources/database_migration_service_connection_profile.libsonnet'),
+  database_migration_service_private_connection: (import 'resources/database_migration_service_private_connection.libsonnet'),
   dataflow_job: (import 'resources/dataflow_job.libsonnet'),
   dataplex_asset: (import 'resources/dataplex_asset.libsonnet'),
   dataplex_asset_iam_binding: (import 'resources/dataplex_asset_iam_binding.libsonnet'),
@@ -384,6 +384,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   dialogflow_entity_type: (import 'resources/dialogflow_entity_type.libsonnet'),
   dialogflow_fulfillment: (import 'resources/dialogflow_fulfillment.libsonnet'),
   dialogflow_intent: (import 'resources/dialogflow_intent.libsonnet'),
+  discovery_engine_chat_engine: (import 'resources/discovery_engine_chat_engine.libsonnet'),
+  discovery_engine_data_store: (import 'resources/discovery_engine_data_store.libsonnet'),
+  discovery_engine_search_engine: (import 'resources/discovery_engine_search_engine.libsonnet'),
   dns_managed_zone: (import 'resources/dns_managed_zone.libsonnet'),
   dns_managed_zone_iam_binding: (import 'resources/dns_managed_zone_iam_binding.libsonnet'),
   dns_managed_zone_iam_member: (import 'resources/dns_managed_zone_iam_member.libsonnet'),
@@ -396,6 +399,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   document_ai_processor_default_version: (import 'resources/document_ai_processor_default_version.libsonnet'),
   document_ai_warehouse_document_schema: (import 'resources/document_ai_warehouse_document_schema.libsonnet'),
   document_ai_warehouse_location: (import 'resources/document_ai_warehouse_location.libsonnet'),
+  edgecontainer_cluster: (import 'resources/edgecontainer_cluster.libsonnet'),
+  edgecontainer_node_pool: (import 'resources/edgecontainer_node_pool.libsonnet'),
+  edgecontainer_vpn_connection: (import 'resources/edgecontainer_vpn_connection.libsonnet'),
   edgenetwork_network: (import 'resources/edgenetwork_network.libsonnet'),
   edgenetwork_subnet: (import 'resources/edgenetwork_subnet.libsonnet'),
   endpoints_service: (import 'resources/endpoints_service.libsonnet'),
@@ -414,6 +420,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   filestore_snapshot: (import 'resources/filestore_snapshot.libsonnet'),
   firebaserules_release: (import 'resources/firebaserules_release.libsonnet'),
   firebaserules_ruleset: (import 'resources/firebaserules_ruleset.libsonnet'),
+  firestore_backup_schedule: (import 'resources/firestore_backup_schedule.libsonnet'),
   firestore_database: (import 'resources/firestore_database.libsonnet'),
   firestore_document: (import 'resources/firestore_document.libsonnet'),
   firestore_field: (import 'resources/firestore_field.libsonnet'),
@@ -425,11 +432,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   folder_iam_member: (import 'resources/folder_iam_member.libsonnet'),
   folder_iam_policy: (import 'resources/folder_iam_policy.libsonnet'),
   folder_organization_policy: (import 'resources/folder_organization_policy.libsonnet'),
-  game_services_game_server_cluster: (import 'resources/game_services_game_server_cluster.libsonnet'),
-  game_services_game_server_config: (import 'resources/game_services_game_server_config.libsonnet'),
-  game_services_game_server_deployment: (import 'resources/game_services_game_server_deployment.libsonnet'),
-  game_services_game_server_deployment_rollout: (import 'resources/game_services_game_server_deployment_rollout.libsonnet'),
-  game_services_realm: (import 'resources/game_services_realm.libsonnet'),
   gke_backup_backup_plan: (import 'resources/gke_backup_backup_plan.libsonnet'),
   gke_backup_backup_plan_iam_binding: (import 'resources/gke_backup_backup_plan_iam_binding.libsonnet'),
   gke_backup_backup_plan_iam_member: (import 'resources/gke_backup_backup_plan_iam_member.libsonnet'),
@@ -443,6 +445,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   gke_hub_feature_iam_member: (import 'resources/gke_hub_feature_iam_member.libsonnet'),
   gke_hub_feature_iam_policy: (import 'resources/gke_hub_feature_iam_policy.libsonnet'),
   gke_hub_feature_membership: (import 'resources/gke_hub_feature_membership.libsonnet'),
+  gke_hub_fleet: (import 'resources/gke_hub_fleet.libsonnet'),
   gke_hub_membership: (import 'resources/gke_hub_membership.libsonnet'),
   gke_hub_membership_binding: (import 'resources/gke_hub_membership_binding.libsonnet'),
   gke_hub_membership_iam_binding: (import 'resources/gke_hub_membership_iam_binding.libsonnet'),
@@ -454,6 +457,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   gke_hub_scope_iam_member: (import 'resources/gke_hub_scope_iam_member.libsonnet'),
   gke_hub_scope_iam_policy: (import 'resources/gke_hub_scope_iam_policy.libsonnet'),
   gke_hub_scope_rbac_role_binding: (import 'resources/gke_hub_scope_rbac_role_binding.libsonnet'),
+  gkeonprem_bare_metal_admin_cluster: (import 'resources/gkeonprem_bare_metal_admin_cluster.libsonnet'),
+  gkeonprem_bare_metal_cluster: (import 'resources/gkeonprem_bare_metal_cluster.libsonnet'),
+  gkeonprem_bare_metal_node_pool: (import 'resources/gkeonprem_bare_metal_node_pool.libsonnet'),
+  gkeonprem_vmware_cluster: (import 'resources/gkeonprem_vmware_cluster.libsonnet'),
+  gkeonprem_vmware_node_pool: (import 'resources/gkeonprem_vmware_node_pool.libsonnet'),
   healthcare_consent_store: (import 'resources/healthcare_consent_store.libsonnet'),
   healthcare_consent_store_iam_binding: (import 'resources/healthcare_consent_store_iam_binding.libsonnet'),
   healthcare_consent_store_iam_member: (import 'resources/healthcare_consent_store_iam_member.libsonnet'),
@@ -518,6 +526,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   identity_platform_tenant_default_supported_idp_config: (import 'resources/identity_platform_tenant_default_supported_idp_config.libsonnet'),
   identity_platform_tenant_inbound_saml_config: (import 'resources/identity_platform_tenant_inbound_saml_config.libsonnet'),
   identity_platform_tenant_oauth_idp_config: (import 'resources/identity_platform_tenant_oauth_idp_config.libsonnet'),
+  integration_connectors_connection: (import 'resources/integration_connectors_connection.libsonnet'),
+  integration_connectors_endpoint_attachment: (import 'resources/integration_connectors_endpoint_attachment.libsonnet'),
   kms_crypto_key: (import 'resources/kms_crypto_key.libsonnet'),
   kms_crypto_key_iam_binding: (import 'resources/kms_crypto_key_iam_binding.libsonnet'),
   kms_crypto_key_iam_member: (import 'resources/kms_crypto_key_iam_member.libsonnet'),
@@ -534,18 +544,21 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   logging_billing_account_sink: (import 'resources/logging_billing_account_sink.libsonnet'),
   logging_folder_bucket_config: (import 'resources/logging_folder_bucket_config.libsonnet'),
   logging_folder_exclusion: (import 'resources/logging_folder_exclusion.libsonnet'),
+  logging_folder_settings: (import 'resources/logging_folder_settings.libsonnet'),
   logging_folder_sink: (import 'resources/logging_folder_sink.libsonnet'),
   logging_linked_dataset: (import 'resources/logging_linked_dataset.libsonnet'),
   logging_log_view: (import 'resources/logging_log_view.libsonnet'),
   logging_metric: (import 'resources/logging_metric.libsonnet'),
   logging_organization_bucket_config: (import 'resources/logging_organization_bucket_config.libsonnet'),
   logging_organization_exclusion: (import 'resources/logging_organization_exclusion.libsonnet'),
+  logging_organization_settings: (import 'resources/logging_organization_settings.libsonnet'),
   logging_organization_sink: (import 'resources/logging_organization_sink.libsonnet'),
   logging_project_bucket_config: (import 'resources/logging_project_bucket_config.libsonnet'),
   logging_project_exclusion: (import 'resources/logging_project_exclusion.libsonnet'),
   logging_project_sink: (import 'resources/logging_project_sink.libsonnet'),
   looker_instance: (import 'resources/looker_instance.libsonnet'),
   memcache_instance: (import 'resources/memcache_instance.libsonnet'),
+  migration_center_group: (import 'resources/migration_center_group.libsonnet'),
   ml_engine_model: (import 'resources/ml_engine_model.libsonnet'),
   monitoring_alert_policy: (import 'resources/monitoring_alert_policy.libsonnet'),
   monitoring_custom_service: (import 'resources/monitoring_custom_service.libsonnet'),
@@ -557,11 +570,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   monitoring_service: (import 'resources/monitoring_service.libsonnet'),
   monitoring_slo: (import 'resources/monitoring_slo.libsonnet'),
   monitoring_uptime_check_config: (import 'resources/monitoring_uptime_check_config.libsonnet'),
+  netapp_active_directory: (import 'resources/netapp_active_directory.libsonnet'),
+  netapp_backup_policy: (import 'resources/netapp_backup_policy.libsonnet'),
+  netapp_backup_vault: (import 'resources/netapp_backup_vault.libsonnet'),
+  netapp_kmsconfig: (import 'resources/netapp_kmsconfig.libsonnet'),
+  netapp_storage_pool: (import 'resources/netapp_storage_pool.libsonnet'),
+  netapp_volume: (import 'resources/netapp_volume.libsonnet'),
+  netapp_volume_snapshot: (import 'resources/netapp_volume_snapshot.libsonnet'),
   network_connectivity_hub: (import 'resources/network_connectivity_hub.libsonnet'),
+  network_connectivity_policy_based_route: (import 'resources/network_connectivity_policy_based_route.libsonnet'),
   network_connectivity_service_connection_policy: (import 'resources/network_connectivity_service_connection_policy.libsonnet'),
   network_connectivity_spoke: (import 'resources/network_connectivity_spoke.libsonnet'),
   network_management_connectivity_test: (import 'resources/network_management_connectivity_test.libsonnet'),
   network_security_address_group: (import 'resources/network_security_address_group.libsonnet'),
+  network_security_address_group_iam_binding: (import 'resources/network_security_address_group_iam_binding.libsonnet'),
+  network_security_address_group_iam_member: (import 'resources/network_security_address_group_iam_member.libsonnet'),
+  network_security_address_group_iam_policy: (import 'resources/network_security_address_group_iam_policy.libsonnet'),
   network_security_gateway_security_policy: (import 'resources/network_security_gateway_security_policy.libsonnet'),
   network_security_gateway_security_policy_rule: (import 'resources/network_security_gateway_security_policy_rule.libsonnet'),
   network_security_url_lists: (import 'resources/network_security_url_lists.libsonnet'),
@@ -579,6 +603,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   notebooks_runtime_iam_binding: (import 'resources/notebooks_runtime_iam_binding.libsonnet'),
   notebooks_runtime_iam_member: (import 'resources/notebooks_runtime_iam_member.libsonnet'),
   notebooks_runtime_iam_policy: (import 'resources/notebooks_runtime_iam_policy.libsonnet'),
+  org_policy_custom_constraint: (import 'resources/org_policy_custom_constraint.libsonnet'),
   org_policy_policy: (import 'resources/org_policy_policy.libsonnet'),
   organization_access_approval_settings: (import 'resources/organization_access_approval_settings.libsonnet'),
   organization_iam_audit_config: (import 'resources/organization_iam_audit_config.libsonnet'),
@@ -616,6 +641,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   pubsub_lite_subscription: (import 'resources/pubsub_lite_subscription.libsonnet'),
   pubsub_lite_topic: (import 'resources/pubsub_lite_topic.libsonnet'),
   pubsub_schema: (import 'resources/pubsub_schema.libsonnet'),
+  pubsub_schema_iam_binding: (import 'resources/pubsub_schema_iam_binding.libsonnet'),
+  pubsub_schema_iam_member: (import 'resources/pubsub_schema_iam_member.libsonnet'),
+  pubsub_schema_iam_policy: (import 'resources/pubsub_schema_iam_policy.libsonnet'),
   pubsub_subscription: (import 'resources/pubsub_subscription.libsonnet'),
   pubsub_subscription_iam_binding: (import 'resources/pubsub_subscription_iam_binding.libsonnet'),
   pubsub_subscription_iam_member: (import 'resources/pubsub_subscription_iam_member.libsonnet'),
@@ -625,10 +653,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   pubsub_topic_iam_member: (import 'resources/pubsub_topic_iam_member.libsonnet'),
   pubsub_topic_iam_policy: (import 'resources/pubsub_topic_iam_policy.libsonnet'),
   recaptcha_enterprise_key: (import 'resources/recaptcha_enterprise_key.libsonnet'),
+  redis_cluster: (import 'resources/redis_cluster.libsonnet'),
   redis_instance: (import 'resources/redis_instance.libsonnet'),
   resource_manager_lien: (import 'resources/resource_manager_lien.libsonnet'),
+  scc_event_threat_detection_custom_module: (import 'resources/scc_event_threat_detection_custom_module.libsonnet'),
+  scc_folder_custom_module: (import 'resources/scc_folder_custom_module.libsonnet'),
   scc_mute_config: (import 'resources/scc_mute_config.libsonnet'),
   scc_notification_config: (import 'resources/scc_notification_config.libsonnet'),
+  scc_organization_custom_module: (import 'resources/scc_organization_custom_module.libsonnet'),
   scc_project_custom_module: (import 'resources/scc_project_custom_module.libsonnet'),
   scc_source: (import 'resources/scc_source.libsonnet'),
   scc_source_iam_binding: (import 'resources/scc_source_iam_binding.libsonnet'),
@@ -639,6 +671,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   secret_manager_secret_iam_member: (import 'resources/secret_manager_secret_iam_member.libsonnet'),
   secret_manager_secret_iam_policy: (import 'resources/secret_manager_secret_iam_policy.libsonnet'),
   secret_manager_secret_version: (import 'resources/secret_manager_secret_version.libsonnet'),
+  secure_source_manager_instance: (import 'resources/secure_source_manager_instance.libsonnet'),
+  secure_source_manager_instance_iam_binding: (import 'resources/secure_source_manager_instance_iam_binding.libsonnet'),
+  secure_source_manager_instance_iam_member: (import 'resources/secure_source_manager_instance_iam_member.libsonnet'),
+  secure_source_manager_instance_iam_policy: (import 'resources/secure_source_manager_instance_iam_policy.libsonnet'),
+  securityposture_posture: (import 'resources/securityposture_posture.libsonnet'),
+  securityposture_posture_deployment: (import 'resources/securityposture_posture_deployment.libsonnet'),
   service_account: (import 'resources/service_account.libsonnet'),
   service_account_iam_binding: (import 'resources/service_account_iam_binding.libsonnet'),
   service_account_iam_member: (import 'resources/service_account_iam_member.libsonnet'),
@@ -692,13 +730,29 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   tpu_node: (import 'resources/tpu_node.libsonnet'),
   vertex_ai_dataset: (import 'resources/vertex_ai_dataset.libsonnet'),
   vertex_ai_endpoint: (import 'resources/vertex_ai_endpoint.libsonnet'),
+  vertex_ai_feature_group: (import 'resources/vertex_ai_feature_group.libsonnet'),
+  vertex_ai_feature_group_feature: (import 'resources/vertex_ai_feature_group_feature.libsonnet'),
+  vertex_ai_feature_online_store: (import 'resources/vertex_ai_feature_online_store.libsonnet'),
+  vertex_ai_feature_online_store_featureview: (import 'resources/vertex_ai_feature_online_store_featureview.libsonnet'),
   vertex_ai_featurestore: (import 'resources/vertex_ai_featurestore.libsonnet'),
   vertex_ai_featurestore_entitytype: (import 'resources/vertex_ai_featurestore_entitytype.libsonnet'),
   vertex_ai_featurestore_entitytype_feature: (import 'resources/vertex_ai_featurestore_entitytype_feature.libsonnet'),
   vertex_ai_index: (import 'resources/vertex_ai_index.libsonnet'),
   vertex_ai_index_endpoint: (import 'resources/vertex_ai_index_endpoint.libsonnet'),
   vertex_ai_tensorboard: (import 'resources/vertex_ai_tensorboard.libsonnet'),
+  vmwareengine_cluster: (import 'resources/vmwareengine_cluster.libsonnet'),
+  vmwareengine_external_access_rule: (import 'resources/vmwareengine_external_access_rule.libsonnet'),
+  vmwareengine_external_address: (import 'resources/vmwareengine_external_address.libsonnet'),
+  vmwareengine_network: (import 'resources/vmwareengine_network.libsonnet'),
+  vmwareengine_network_peering: (import 'resources/vmwareengine_network_peering.libsonnet'),
+  vmwareengine_network_policy: (import 'resources/vmwareengine_network_policy.libsonnet'),
+  vmwareengine_private_cloud: (import 'resources/vmwareengine_private_cloud.libsonnet'),
+  vmwareengine_subnet: (import 'resources/vmwareengine_subnet.libsonnet'),
   vpc_access_connector: (import 'resources/vpc_access_connector.libsonnet'),
+  workbench_instance: (import 'resources/workbench_instance.libsonnet'),
+  workbench_instance_iam_binding: (import 'resources/workbench_instance_iam_binding.libsonnet'),
+  workbench_instance_iam_member: (import 'resources/workbench_instance_iam_member.libsonnet'),
+  workbench_instance_iam_policy: (import 'resources/workbench_instance_iam_policy.libsonnet'),
   workflows_workflow: (import 'resources/workflows_workflow.libsonnet'),
   data: (import 'data/main.libsonnet'),
 }
diff --git a/4.x/_gen/provider_google.libsonnet b/4.x/_gen/provider_google.libsonnet
index 00871df2..dbfa3057 100644
--- a/4.x/_gen/provider_google.libsonnet
+++ b/4.x/_gen/provider_google.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='provider', url='', help='`provider` represents the `google` Terraform provider config.\n\n\n\nThis package contains functions and utilities for setting up the provider using Jsonnet code.\n'),
-  '#new':: d.fn(help='\n`google.provider.new` injects a new `google` Terraform `provider`\nblock into the root module document.\n\nOptionally, this inserts the provider into the\n[required_providers](https://developer.hashicorp.com/terraform/language/providers/requirements) `terraform` sub block if\nthe `src` and/or `version` parameters are set.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting provider block. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting provider block. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting provider block. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting provider block. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting provider block. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting provider block. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting provider block. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting provider block. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting provider block. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting provider block. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting provider block. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting provider block. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting provider block. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting provider block. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting provider block. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting provider block. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting provider block. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting provider block. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting provider block. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting provider block. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting provider block. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting provider block. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting provider block. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting provider block. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting provider block. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting provider block. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting provider block. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting provider block. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting provider block. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting provider block. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting provider block. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting provider block. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting provider block. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting provider block. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting provider block. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting provider block. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting provider block. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting provider block. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting provider block. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting provider block. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting provider block. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting provider block. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting provider block. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting provider block. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting provider block. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting provider block. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting provider block. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting provider block. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting provider block. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting provider block. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting provider block. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting provider block. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting provider block. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting provider block. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting provider block. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting provider block. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting provider block. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting provider block. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting provider block. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting provider block. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting provider block. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting provider block. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting provider block. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting provider block. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting provider block. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting provider block. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting provider block. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting provider block. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting provider block. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting provider block. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting provider block. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting provider block. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting provider block. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting provider block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting provider block. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting provider block. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting provider block. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting provider block. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting provider block. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting provider block. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting provider block. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting provider block. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting provider block. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting provider block. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting provider block. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting provider block. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting provider block. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting provider block. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting provider block. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting provider block. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting provider block. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting provider block. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting provider block. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting provider block. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting provider block. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting provider block. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting provider block. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting provider block. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting provider block. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n  - `alias` (`string`): The provider `alias` to set for this instance of the provider block. When `null`, the `alias`\n  field will be omitted from the resulting provider block.\n  - `src` (`string`): The provider `source` to set on the resulting `required_providers` block. If `src` or `version` is\n  set and is not `null`, a `required_providers` block and entry for the provider will be injected into the document.\n  - `version` (`string`): The provider `version` to set on the resulting `required_providers` block. If `src` or\n  `version` is set and is not `null`, a `required_providers` block and entry for the provider will be injected into the\n  document.\n\n\n**Returns**:\n- A mixin object that injects the new provider (and optionally, `required_providers` block) into the root Terraform configuration.\n', args=[]),
+  '#new':: d.fn(help='\n`google.provider.new` injects a new `google` Terraform `provider`\nblock into the root module document.\n\nOptionally, this inserts the provider into the\n[required_providers](https://developer.hashicorp.com/terraform/language/providers/requirements) `terraform` sub block if\nthe `src` and/or `version` parameters are set.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting provider block. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting provider block. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting provider block. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting provider block. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting provider block. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting provider block. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting provider block. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting provider block. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting provider block. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting provider block. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting provider block. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting provider block. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting provider block. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting provider block. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting provider block. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting provider block. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting provider block. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `blockchain_node_engine_custom_endpoint` (`string`): Set the `blockchain_node_engine_custom_endpoint` field on the resulting provider block. When `null`, the `blockchain_node_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting provider block. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting provider block. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddomains_custom_endpoint` (`string`): Set the `clouddomains_custom_endpoint` field on the resulting provider block. When `null`, the `clouddomains_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting provider block. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting provider block. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting provider block. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting provider block. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting provider block. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting provider block. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting provider block. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting provider block. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting provider block. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting provider block. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting provider block. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting provider block. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting provider block. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting provider block. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting provider block. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting provider block. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting provider block. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting provider block. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `default_labels` (`obj`): Set the `default_labels` field on the resulting provider block. When `null`, the `default_labels` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting provider block. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `discovery_engine_custom_endpoint` (`string`): Set the `discovery_engine_custom_endpoint` field on the resulting provider block. When `null`, the `discovery_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting provider block. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting provider block. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting provider block. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting provider block. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting provider block. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting provider block. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting provider block. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting provider block. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting provider block. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting provider block. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting provider block. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting provider block. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting provider block. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting provider block. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting provider block. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting provider block. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting provider block. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting provider block. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting provider block. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting provider block. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting provider block. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `integration_connectors_custom_endpoint` (`string`): Set the `integration_connectors_custom_endpoint` field on the resulting provider block. When `null`, the `integration_connectors_custom_endpoint` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting provider block. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting provider block. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting provider block. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting provider block. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `migration_center_custom_endpoint` (`string`): Set the `migration_center_custom_endpoint` field on the resulting provider block. When `null`, the `migration_center_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting provider block. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting provider block. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `netapp_custom_endpoint` (`string`): Set the `netapp_custom_endpoint` field on the resulting provider block. When `null`, the `netapp_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting provider block. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting provider block. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting provider block. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting provider block. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting provider block. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting provider block. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting provider block. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting provider block. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting provider block. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting provider block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting provider block. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting provider block. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting provider block. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting provider block. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting provider block. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting provider block. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting provider block. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `secure_source_manager_custom_endpoint` (`string`): Set the `secure_source_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secure_source_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting provider block. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `securityposture_custom_endpoint` (`string`): Set the `securityposture_custom_endpoint` field on the resulting provider block. When `null`, the `securityposture_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting provider block. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting provider block. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting provider block. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting provider block. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting provider block. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting provider block. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting provider block. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting provider block. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting provider block. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting provider block. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting provider block. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting provider block. When `null`, the `universe_domain` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting provider block. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting provider block. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vmwareengine_custom_endpoint` (`string`): Set the `vmwareengine_custom_endpoint` field on the resulting provider block. When `null`, the `vmwareengine_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting provider block. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workbench_custom_endpoint` (`string`): Set the `workbench_custom_endpoint` field on the resulting provider block. When `null`, the `workbench_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting provider block. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting provider block. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting provider block. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n  - `alias` (`string`): The provider `alias` to set for this instance of the provider block. When `null`, the `alias`\n  field will be omitted from the resulting provider block.\n  - `src` (`string`): The provider `source` to set on the resulting `required_providers` block. If `src` or `version` is\n  set and is not `null`, a `required_providers` block and entry for the provider will be injected into the document.\n  - `version` (`string`): The provider `version` to set on the resulting `required_providers` block. If `src` or\n  `version` is set and is not `null`, a `required_providers` block and entry for the provider will be injected into the\n  document.\n\n\n**Returns**:\n- A mixin object that injects the new provider (and optionally, `required_providers` block) into the root Terraform configuration.\n', args=[]),
   new(
     access_approval_custom_endpoint=null,
     access_context_manager_custom_endpoint=null,
@@ -27,6 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     billing_custom_endpoint=null,
     billing_project=null,
     binary_authorization_custom_endpoint=null,
+    blockchain_node_engine_custom_endpoint=null,
     certificate_manager_custom_endpoint=null,
     cloud_asset_custom_endpoint=null,
     cloud_billing_custom_endpoint=null,
@@ -35,7 +36,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_functions_custom_endpoint=null,
     cloud_identity_custom_endpoint=null,
     cloud_ids_custom_endpoint=null,
-    cloud_iot_custom_endpoint=null,
     cloud_resource_manager_custom_endpoint=null,
     cloud_run_custom_endpoint=null,
     cloud_run_v2_custom_endpoint=null,
@@ -43,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_tasks_custom_endpoint=null,
     cloudbuildv2_custom_endpoint=null,
     clouddeploy_custom_endpoint=null,
+    clouddomains_custom_endpoint=null,
     cloudfunctions2_custom_endpoint=null,
     composer_custom_endpoint=null,
     compute_custom_endpoint=null,
@@ -64,23 +65,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     dataproc_metastore_custom_endpoint=null,
     datastore_custom_endpoint=null,
     datastream_custom_endpoint=null,
+    default_labels=null,
     deployment_manager_custom_endpoint=null,
     dialogflow_custom_endpoint=null,
     dialogflow_cx_custom_endpoint=null,
+    discovery_engine_custom_endpoint=null,
     dns_custom_endpoint=null,
     document_ai_custom_endpoint=null,
     document_ai_warehouse_custom_endpoint=null,
+    edgecontainer_custom_endpoint=null,
     edgenetwork_custom_endpoint=null,
     essential_contacts_custom_endpoint=null,
     eventarc_custom_endpoint=null,
     filestore_custom_endpoint=null,
     firebaserules_custom_endpoint=null,
     firestore_custom_endpoint=null,
-    game_services_custom_endpoint=null,
     gke_backup_custom_endpoint=null,
     gke_hub2_custom_endpoint=null,
     gke_hub_custom_endpoint=null,
     gkehub_feature_custom_endpoint=null,
+    gkeonprem_custom_endpoint=null,
     healthcare_custom_endpoint=null,
     iam2_custom_endpoint=null,
     iam_beta_custom_endpoint=null,
@@ -91,12 +95,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity_platform_custom_endpoint=null,
     impersonate_service_account=null,
     impersonate_service_account_delegates=null,
+    integration_connectors_custom_endpoint=null,
     kms_custom_endpoint=null,
     logging_custom_endpoint=null,
     looker_custom_endpoint=null,
     memcache_custom_endpoint=null,
+    migration_center_custom_endpoint=null,
     ml_engine_custom_endpoint=null,
     monitoring_custom_endpoint=null,
+    netapp_custom_endpoint=null,
     network_connectivity_custom_endpoint=null,
     network_management_custom_endpoint=null,
     network_security_custom_endpoint=null,
@@ -119,7 +126,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     resource_manager_v3_custom_endpoint=null,
     scopes=null,
     secret_manager_custom_endpoint=null,
+    secure_source_manager_custom_endpoint=null,
     security_center_custom_endpoint=null,
+    securityposture_custom_endpoint=null,
     service_management_custom_endpoint=null,
     service_networking_custom_endpoint=null,
     service_usage_custom_endpoint=null,
@@ -132,9 +141,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tags_custom_endpoint=null,
     tags_location_custom_endpoint=null,
     tpu_custom_endpoint=null,
+    universe_domain=null,
     user_project_override=null,
     vertex_ai_custom_endpoint=null,
+    vmwareengine_custom_endpoint=null,
     vpc_access_custom_endpoint=null,
+    workbench_custom_endpoint=null,
     workflows_custom_endpoint=null,
     zone=null,
     alias=null,
@@ -169,6 +181,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       billing_custom_endpoint=billing_custom_endpoint,
       billing_project=billing_project,
       binary_authorization_custom_endpoint=binary_authorization_custom_endpoint,
+      blockchain_node_engine_custom_endpoint=blockchain_node_engine_custom_endpoint,
       certificate_manager_custom_endpoint=certificate_manager_custom_endpoint,
       cloud_asset_custom_endpoint=cloud_asset_custom_endpoint,
       cloud_billing_custom_endpoint=cloud_billing_custom_endpoint,
@@ -177,7 +190,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cloud_functions_custom_endpoint=cloud_functions_custom_endpoint,
       cloud_identity_custom_endpoint=cloud_identity_custom_endpoint,
       cloud_ids_custom_endpoint=cloud_ids_custom_endpoint,
-      cloud_iot_custom_endpoint=cloud_iot_custom_endpoint,
       cloud_resource_manager_custom_endpoint=cloud_resource_manager_custom_endpoint,
       cloud_run_custom_endpoint=cloud_run_custom_endpoint,
       cloud_run_v2_custom_endpoint=cloud_run_v2_custom_endpoint,
@@ -185,6 +197,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cloud_tasks_custom_endpoint=cloud_tasks_custom_endpoint,
       cloudbuildv2_custom_endpoint=cloudbuildv2_custom_endpoint,
       clouddeploy_custom_endpoint=clouddeploy_custom_endpoint,
+      clouddomains_custom_endpoint=clouddomains_custom_endpoint,
       cloudfunctions2_custom_endpoint=cloudfunctions2_custom_endpoint,
       composer_custom_endpoint=composer_custom_endpoint,
       compute_custom_endpoint=compute_custom_endpoint,
@@ -206,23 +219,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       dataproc_metastore_custom_endpoint=dataproc_metastore_custom_endpoint,
       datastore_custom_endpoint=datastore_custom_endpoint,
       datastream_custom_endpoint=datastream_custom_endpoint,
+      default_labels=default_labels,
       deployment_manager_custom_endpoint=deployment_manager_custom_endpoint,
       dialogflow_custom_endpoint=dialogflow_custom_endpoint,
       dialogflow_cx_custom_endpoint=dialogflow_cx_custom_endpoint,
+      discovery_engine_custom_endpoint=discovery_engine_custom_endpoint,
       dns_custom_endpoint=dns_custom_endpoint,
       document_ai_custom_endpoint=document_ai_custom_endpoint,
       document_ai_warehouse_custom_endpoint=document_ai_warehouse_custom_endpoint,
+      edgecontainer_custom_endpoint=edgecontainer_custom_endpoint,
       edgenetwork_custom_endpoint=edgenetwork_custom_endpoint,
       essential_contacts_custom_endpoint=essential_contacts_custom_endpoint,
       eventarc_custom_endpoint=eventarc_custom_endpoint,
       filestore_custom_endpoint=filestore_custom_endpoint,
       firebaserules_custom_endpoint=firebaserules_custom_endpoint,
       firestore_custom_endpoint=firestore_custom_endpoint,
-      game_services_custom_endpoint=game_services_custom_endpoint,
       gke_backup_custom_endpoint=gke_backup_custom_endpoint,
       gke_hub2_custom_endpoint=gke_hub2_custom_endpoint,
       gke_hub_custom_endpoint=gke_hub_custom_endpoint,
       gkehub_feature_custom_endpoint=gkehub_feature_custom_endpoint,
+      gkeonprem_custom_endpoint=gkeonprem_custom_endpoint,
       healthcare_custom_endpoint=healthcare_custom_endpoint,
       iam2_custom_endpoint=iam2_custom_endpoint,
       iam_beta_custom_endpoint=iam_beta_custom_endpoint,
@@ -233,12 +249,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       identity_platform_custom_endpoint=identity_platform_custom_endpoint,
       impersonate_service_account=impersonate_service_account,
       impersonate_service_account_delegates=impersonate_service_account_delegates,
+      integration_connectors_custom_endpoint=integration_connectors_custom_endpoint,
       kms_custom_endpoint=kms_custom_endpoint,
       logging_custom_endpoint=logging_custom_endpoint,
       looker_custom_endpoint=looker_custom_endpoint,
       memcache_custom_endpoint=memcache_custom_endpoint,
+      migration_center_custom_endpoint=migration_center_custom_endpoint,
       ml_engine_custom_endpoint=ml_engine_custom_endpoint,
       monitoring_custom_endpoint=monitoring_custom_endpoint,
+      netapp_custom_endpoint=netapp_custom_endpoint,
       network_connectivity_custom_endpoint=network_connectivity_custom_endpoint,
       network_management_custom_endpoint=network_management_custom_endpoint,
       network_security_custom_endpoint=network_security_custom_endpoint,
@@ -261,7 +280,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       resource_manager_v3_custom_endpoint=resource_manager_v3_custom_endpoint,
       scopes=scopes,
       secret_manager_custom_endpoint=secret_manager_custom_endpoint,
+      secure_source_manager_custom_endpoint=secure_source_manager_custom_endpoint,
       security_center_custom_endpoint=security_center_custom_endpoint,
+      securityposture_custom_endpoint=securityposture_custom_endpoint,
       service_management_custom_endpoint=service_management_custom_endpoint,
       service_networking_custom_endpoint=service_networking_custom_endpoint,
       service_usage_custom_endpoint=service_usage_custom_endpoint,
@@ -274,14 +295,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       tags_custom_endpoint=tags_custom_endpoint,
       tags_location_custom_endpoint=tags_location_custom_endpoint,
       tpu_custom_endpoint=tpu_custom_endpoint,
+      universe_domain=universe_domain,
       user_project_override=user_project_override,
       vertex_ai_custom_endpoint=vertex_ai_custom_endpoint,
+      vmwareengine_custom_endpoint=vmwareengine_custom_endpoint,
       vpc_access_custom_endpoint=vpc_access_custom_endpoint,
+      workbench_custom_endpoint=workbench_custom_endpoint,
       workflows_custom_endpoint=workflows_custom_endpoint,
       zone=zone
     )
   ),
-  '#newAttrs':: d.fn(help='\n`google.provider.` constructs a new object with attributes and blocks configured for the `google`\nTerraform `provider`.\n\nUnlike [google.provider.new](#fn-googlenew), this function will not inject the `provider`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting object. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting object. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting object. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting object. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting object. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting object. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting object. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting object. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting object. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting object. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting object. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting object. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting object. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting object. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting object. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting object. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting object. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting object. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting object. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting object. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting object. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting object. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting object. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting object. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting object. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting object. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting object. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting object. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting object. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting object. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting object. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting object. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting object. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting object. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting object. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting object. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting object. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting object. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting object. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting object. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting object. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting object. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting object. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting object. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting object. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting object. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting object. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting object. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting object. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting object. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting object. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting object. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting object. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting object. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting object. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting object. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting object. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting object. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting object. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting object. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting object. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting object. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting object. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting object. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting object. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting object. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting object. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting object. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting object. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting object. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting object. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting object. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting object. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting object. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting object. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting object. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting object. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting object. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting object. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting object. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting object. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting object. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting object. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting object. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting object. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting object. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting object. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting object. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting object. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting object. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting object. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting object. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting object. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting object. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting object. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting object. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting object. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting object. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting object. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting object. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting object. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting object. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting object. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting object. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting object. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting object. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting object. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting object. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting object. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting object. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting object. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting object. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting object. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting object. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting object. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting object. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting object. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting object. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting object. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting object. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting object. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting object. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting object. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) to construct a new `google` provider\n  configuration into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.provider.` constructs a new object with attributes and blocks configured for the `google`\nTerraform `provider`.\n\nUnlike [google.provider.new](#fn-googlenew), this function will not inject the `provider`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting object. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting object. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting object. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting object. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting object. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting object. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting object. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting object. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting object. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting object. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting object. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting object. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting object. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting object. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting object. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting object. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting object. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting object. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting object. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting object. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting object. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting object. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `blockchain_node_engine_custom_endpoint` (`string`): Set the `blockchain_node_engine_custom_endpoint` field on the resulting object. When `null`, the `blockchain_node_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting object. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting object. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting object. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting object. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting object. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting object. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting object. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting object. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting object. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting object. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting object. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddomains_custom_endpoint` (`string`): Set the `clouddomains_custom_endpoint` field on the resulting object. When `null`, the `clouddomains_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting object. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting object. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting object. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting object. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting object. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting object. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting object. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting object. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting object. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting object. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting object. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting object. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting object. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting object. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting object. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting object. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting object. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting object. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting object. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting object. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting object. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `default_labels` (`obj`): Set the `default_labels` field on the resulting object. When `null`, the `default_labels` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting object. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `discovery_engine_custom_endpoint` (`string`): Set the `discovery_engine_custom_endpoint` field on the resulting object. When `null`, the `discovery_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting object. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting object. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting object. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting object. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting object. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting object. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting object. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting object. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting object. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting object. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting object. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting object. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting object. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting object. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting object. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting object. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting object. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting object. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting object. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting object. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting object. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting object. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting object. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting object. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting object. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `integration_connectors_custom_endpoint` (`string`): Set the `integration_connectors_custom_endpoint` field on the resulting object. When `null`, the `integration_connectors_custom_endpoint` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting object. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting object. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting object. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting object. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `migration_center_custom_endpoint` (`string`): Set the `migration_center_custom_endpoint` field on the resulting object. When `null`, the `migration_center_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting object. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting object. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `netapp_custom_endpoint` (`string`): Set the `netapp_custom_endpoint` field on the resulting object. When `null`, the `netapp_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting object. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting object. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting object. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting object. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting object. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting object. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting object. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting object. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting object. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting object. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting object. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting object. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting object. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting object. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting object. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting object. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting object. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting object. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `secure_source_manager_custom_endpoint` (`string`): Set the `secure_source_manager_custom_endpoint` field on the resulting object. When `null`, the `secure_source_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting object. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `securityposture_custom_endpoint` (`string`): Set the `securityposture_custom_endpoint` field on the resulting object. When `null`, the `securityposture_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting object. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting object. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting object. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting object. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting object. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting object. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting object. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting object. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting object. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting object. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting object. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting object. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting object. When `null`, the `universe_domain` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting object. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting object. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vmwareengine_custom_endpoint` (`string`): Set the `vmwareengine_custom_endpoint` field on the resulting object. When `null`, the `vmwareengine_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting object. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workbench_custom_endpoint` (`string`): Set the `workbench_custom_endpoint` field on the resulting object. When `null`, the `workbench_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting object. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting object. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting object. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) to construct a new `google` provider\n  configuration into the root Terraform configuration.\n', args=[]),
   newAttrs(
     access_approval_custom_endpoint=null,
     access_context_manager_custom_endpoint=null,
@@ -306,6 +330,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     billing_custom_endpoint=null,
     billing_project=null,
     binary_authorization_custom_endpoint=null,
+    blockchain_node_engine_custom_endpoint=null,
     certificate_manager_custom_endpoint=null,
     cloud_asset_custom_endpoint=null,
     cloud_billing_custom_endpoint=null,
@@ -314,7 +339,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_functions_custom_endpoint=null,
     cloud_identity_custom_endpoint=null,
     cloud_ids_custom_endpoint=null,
-    cloud_iot_custom_endpoint=null,
     cloud_resource_manager_custom_endpoint=null,
     cloud_run_custom_endpoint=null,
     cloud_run_v2_custom_endpoint=null,
@@ -322,6 +346,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_tasks_custom_endpoint=null,
     cloudbuildv2_custom_endpoint=null,
     clouddeploy_custom_endpoint=null,
+    clouddomains_custom_endpoint=null,
     cloudfunctions2_custom_endpoint=null,
     composer_custom_endpoint=null,
     compute_custom_endpoint=null,
@@ -343,23 +368,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     dataproc_metastore_custom_endpoint=null,
     datastore_custom_endpoint=null,
     datastream_custom_endpoint=null,
+    default_labels=null,
     deployment_manager_custom_endpoint=null,
     dialogflow_custom_endpoint=null,
     dialogflow_cx_custom_endpoint=null,
+    discovery_engine_custom_endpoint=null,
     dns_custom_endpoint=null,
     document_ai_custom_endpoint=null,
     document_ai_warehouse_custom_endpoint=null,
+    edgecontainer_custom_endpoint=null,
     edgenetwork_custom_endpoint=null,
     essential_contacts_custom_endpoint=null,
     eventarc_custom_endpoint=null,
     filestore_custom_endpoint=null,
     firebaserules_custom_endpoint=null,
     firestore_custom_endpoint=null,
-    game_services_custom_endpoint=null,
     gke_backup_custom_endpoint=null,
     gke_hub2_custom_endpoint=null,
     gke_hub_custom_endpoint=null,
     gkehub_feature_custom_endpoint=null,
+    gkeonprem_custom_endpoint=null,
     healthcare_custom_endpoint=null,
     iam2_custom_endpoint=null,
     iam_beta_custom_endpoint=null,
@@ -370,12 +398,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity_platform_custom_endpoint=null,
     impersonate_service_account=null,
     impersonate_service_account_delegates=null,
+    integration_connectors_custom_endpoint=null,
     kms_custom_endpoint=null,
     logging_custom_endpoint=null,
     looker_custom_endpoint=null,
     memcache_custom_endpoint=null,
+    migration_center_custom_endpoint=null,
     ml_engine_custom_endpoint=null,
     monitoring_custom_endpoint=null,
+    netapp_custom_endpoint=null,
     network_connectivity_custom_endpoint=null,
     network_management_custom_endpoint=null,
     network_security_custom_endpoint=null,
@@ -398,7 +429,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     resource_manager_v3_custom_endpoint=null,
     scopes=null,
     secret_manager_custom_endpoint=null,
+    secure_source_manager_custom_endpoint=null,
     security_center_custom_endpoint=null,
+    securityposture_custom_endpoint=null,
     service_management_custom_endpoint=null,
     service_networking_custom_endpoint=null,
     service_usage_custom_endpoint=null,
@@ -411,9 +444,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tags_custom_endpoint=null,
     tags_location_custom_endpoint=null,
     tpu_custom_endpoint=null,
+    universe_domain=null,
     user_project_override=null,
     vertex_ai_custom_endpoint=null,
+    vmwareengine_custom_endpoint=null,
     vpc_access_custom_endpoint=null,
+    workbench_custom_endpoint=null,
     workflows_custom_endpoint=null,
     zone=null
   ):: std.prune(a={
@@ -440,6 +476,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     billing_custom_endpoint: billing_custom_endpoint,
     billing_project: billing_project,
     binary_authorization_custom_endpoint: binary_authorization_custom_endpoint,
+    blockchain_node_engine_custom_endpoint: blockchain_node_engine_custom_endpoint,
     certificate_manager_custom_endpoint: certificate_manager_custom_endpoint,
     cloud_asset_custom_endpoint: cloud_asset_custom_endpoint,
     cloud_billing_custom_endpoint: cloud_billing_custom_endpoint,
@@ -448,7 +485,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_functions_custom_endpoint: cloud_functions_custom_endpoint,
     cloud_identity_custom_endpoint: cloud_identity_custom_endpoint,
     cloud_ids_custom_endpoint: cloud_ids_custom_endpoint,
-    cloud_iot_custom_endpoint: cloud_iot_custom_endpoint,
     cloud_resource_manager_custom_endpoint: cloud_resource_manager_custom_endpoint,
     cloud_run_custom_endpoint: cloud_run_custom_endpoint,
     cloud_run_v2_custom_endpoint: cloud_run_v2_custom_endpoint,
@@ -456,6 +492,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_tasks_custom_endpoint: cloud_tasks_custom_endpoint,
     cloudbuildv2_custom_endpoint: cloudbuildv2_custom_endpoint,
     clouddeploy_custom_endpoint: clouddeploy_custom_endpoint,
+    clouddomains_custom_endpoint: clouddomains_custom_endpoint,
     cloudfunctions2_custom_endpoint: cloudfunctions2_custom_endpoint,
     composer_custom_endpoint: composer_custom_endpoint,
     compute_custom_endpoint: compute_custom_endpoint,
@@ -477,23 +514,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     dataproc_metastore_custom_endpoint: dataproc_metastore_custom_endpoint,
     datastore_custom_endpoint: datastore_custom_endpoint,
     datastream_custom_endpoint: datastream_custom_endpoint,
+    default_labels: default_labels,
     deployment_manager_custom_endpoint: deployment_manager_custom_endpoint,
     dialogflow_custom_endpoint: dialogflow_custom_endpoint,
     dialogflow_cx_custom_endpoint: dialogflow_cx_custom_endpoint,
+    discovery_engine_custom_endpoint: discovery_engine_custom_endpoint,
     dns_custom_endpoint: dns_custom_endpoint,
     document_ai_custom_endpoint: document_ai_custom_endpoint,
     document_ai_warehouse_custom_endpoint: document_ai_warehouse_custom_endpoint,
+    edgecontainer_custom_endpoint: edgecontainer_custom_endpoint,
     edgenetwork_custom_endpoint: edgenetwork_custom_endpoint,
     essential_contacts_custom_endpoint: essential_contacts_custom_endpoint,
     eventarc_custom_endpoint: eventarc_custom_endpoint,
     filestore_custom_endpoint: filestore_custom_endpoint,
     firebaserules_custom_endpoint: firebaserules_custom_endpoint,
     firestore_custom_endpoint: firestore_custom_endpoint,
-    game_services_custom_endpoint: game_services_custom_endpoint,
     gke_backup_custom_endpoint: gke_backup_custom_endpoint,
     gke_hub2_custom_endpoint: gke_hub2_custom_endpoint,
     gke_hub_custom_endpoint: gke_hub_custom_endpoint,
     gkehub_feature_custom_endpoint: gkehub_feature_custom_endpoint,
+    gkeonprem_custom_endpoint: gkeonprem_custom_endpoint,
     healthcare_custom_endpoint: healthcare_custom_endpoint,
     iam2_custom_endpoint: iam2_custom_endpoint,
     iam_beta_custom_endpoint: iam_beta_custom_endpoint,
@@ -504,12 +544,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity_platform_custom_endpoint: identity_platform_custom_endpoint,
     impersonate_service_account: impersonate_service_account,
     impersonate_service_account_delegates: impersonate_service_account_delegates,
+    integration_connectors_custom_endpoint: integration_connectors_custom_endpoint,
     kms_custom_endpoint: kms_custom_endpoint,
     logging_custom_endpoint: logging_custom_endpoint,
     looker_custom_endpoint: looker_custom_endpoint,
     memcache_custom_endpoint: memcache_custom_endpoint,
+    migration_center_custom_endpoint: migration_center_custom_endpoint,
     ml_engine_custom_endpoint: ml_engine_custom_endpoint,
     monitoring_custom_endpoint: monitoring_custom_endpoint,
+    netapp_custom_endpoint: netapp_custom_endpoint,
     network_connectivity_custom_endpoint: network_connectivity_custom_endpoint,
     network_management_custom_endpoint: network_management_custom_endpoint,
     network_security_custom_endpoint: network_security_custom_endpoint,
@@ -532,7 +575,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     resource_manager_v3_custom_endpoint: resource_manager_v3_custom_endpoint,
     scopes: scopes,
     secret_manager_custom_endpoint: secret_manager_custom_endpoint,
+    secure_source_manager_custom_endpoint: secure_source_manager_custom_endpoint,
     security_center_custom_endpoint: security_center_custom_endpoint,
+    securityposture_custom_endpoint: securityposture_custom_endpoint,
     service_management_custom_endpoint: service_management_custom_endpoint,
     service_networking_custom_endpoint: service_networking_custom_endpoint,
     service_usage_custom_endpoint: service_usage_custom_endpoint,
@@ -545,9 +590,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tags_custom_endpoint: tags_custom_endpoint,
     tags_location_custom_endpoint: tags_location_custom_endpoint,
     tpu_custom_endpoint: tpu_custom_endpoint,
+    universe_domain: universe_domain,
     user_project_override: user_project_override,
     vertex_ai_custom_endpoint: vertex_ai_custom_endpoint,
+    vmwareengine_custom_endpoint: vmwareengine_custom_endpoint,
     vpc_access_custom_endpoint: vpc_access_custom_endpoint,
+    workbench_custom_endpoint: workbench_custom_endpoint,
     workflows_custom_endpoint: workflows_custom_endpoint,
     zone: zone,
   }),
diff --git a/4.x/_gen/resources/access_context_manager_access_level.libsonnet b/4.x/_gen/resources/access_context_manager_access_level.libsonnet
index 3fa88717..f9123805 100644
--- a/4.x/_gen/resources/access_context_manager_access_level.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_access_level.libsonnet
@@ -34,14 +34,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           }),
         },
       },
-      '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.device_policy.new](#fn-basicbasicdevice_policynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.device_policy.new](#fn-basicbasicdevice_policynew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new](#fn-basicbasicvpc_network_sourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
       new(
         device_policy=null,
         ip_subnetworks=null,
         members=null,
         negate=null,
         regions=null,
-        required_access_levels=null
+        required_access_levels=null,
+        vpc_network_sources=null
       ):: std.prune(a={
         device_policy: device_policy,
         ip_subnetworks: ip_subnetworks,
@@ -49,7 +50,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         negate: negate,
         regions: regions,
         required_access_levels: required_access_levels,
+        vpc_network_sources: vpc_network_sources,
       }),
+      vpc_network_sources:: {
+        '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-basicbasicconditionsvpc_subnetworknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vpc_network_sources` sub block.\n', args=[]),
+        new(
+          vpc_subnetwork=null
+        ):: std.prune(a={
+          vpc_subnetwork: vpc_subnetwork,
+        }),
+        vpc_subnetwork:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.\n  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_subnetwork` sub block.\n', args=[]),
+          new(
+            network,
+            vpc_ip_subnetworks=null
+          ):: std.prune(a={
+            network: network,
+            vpc_ip_subnetworks: vpc_ip_subnetworks,
+          }),
+        },
+      },
     },
     '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.new` constructs a new object with attributes and blocks configured for the `basic`\nTerraform sub block.\n\n\n\n**Args**:\n  - `combining_function` (`string`): How the conditions list should be combined to determine if a request\nis granted this AccessLevel. If AND is used, each Condition in\nconditions must be satisfied for the AccessLevel to be applied. If\nOR is used, at least one Condition in conditions must be satisfied\nfor the AccessLevel to be applied. Default value: "AND" Possible values: ["AND", "OR"] When `null`, the `combining_function` field will be omitted from the resulting object.\n  - `conditions` (`list[obj]`): A set of requirements for the AccessLevel to be granted. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.new](#fn-basicconditionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `basic` sub block.\n', args=[]),
     new(
diff --git a/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet b/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet
index 74c554a0..6f36ed55 100644
--- a/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet
@@ -30,7 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.access_context_manager_access_level_condition.new` injects a new `google_access_context_manager_access_level_condition` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.access_context_manager_access_level_condition.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.access_context_manager_access_level_condition` using the reference:\n\n    $._ref.google_access_context_manager_access_level_condition.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_access_context_manager_access_level_condition.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n\u0026#34;192.0.2.0/24\u0026#34; is accepted but \u0026#34;192.0.2.1/24\u0026#34; is not. Similarly,\nfor IPv6, \u0026#34;2001:db8::/32\u0026#34; is accepted whereas \u0026#34;2001:db8::1/32\u0026#34;\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: \u0026#39;user:{emailid}\u0026#39;, \u0026#39;serviceAccount:{emailid}\u0026#39; When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.access_context_manager_access_level_condition.new` injects a new `google_access_context_manager_access_level_condition` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.access_context_manager_access_level_condition.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.access_context_manager_access_level_condition` using the reference:\n\n    $._ref.google_access_context_manager_access_level_condition.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_access_context_manager_access_level_condition.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n\u0026#34;192.0.2.0/24\u0026#34; is accepted but \u0026#34;192.0.2.1/24\u0026#34; is not. Similarly,\nfor IPv6, \u0026#34;2001:db8::/32\u0026#34; is accepted whereas \u0026#34;2001:db8::1/32\u0026#34;\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: \u0026#39;user:{emailid}\u0026#39;, \u0026#39;serviceAccount:{emailid}\u0026#39; When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with \u0026#39;ip_subnetworks\u0026#39;. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     access_level,
@@ -41,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     regions=null,
     required_access_levels=null,
     timeouts=null,
+    vpc_network_sources=null,
     _meta={}
   ):: tf.withResource(
     type='google_access_context_manager_access_level_condition',
@@ -53,11 +54,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       negate=negate,
       regions=regions,
       required_access_levels=required_access_levels,
-      timeouts=timeouts
+      timeouts=timeouts,
+      vpc_network_sources=vpc_network_sources
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.access_context_manager_access_level_condition.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_access_level_condition`\nTerraform resource.\n\nUnlike [google.access_context_manager_access_level_condition.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_access_level_condition` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.access_context_manager_access_level_condition.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_access_level_condition`\nTerraform resource.\n\nUnlike [google.access_context_manager_access_level_condition.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_access_level_condition` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     access_level,
     device_policy=null,
@@ -66,7 +68,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     negate=null,
     regions=null,
     required_access_levels=null,
-    timeouts=null
+    timeouts=null,
+    vpc_network_sources=null
   ):: std.prune(a={
     access_level: access_level,
     device_policy: device_policy,
@@ -76,6 +79,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     regions: regions,
     required_access_levels: required_access_levels,
     timeouts: timeouts,
+    vpc_network_sources: vpc_network_sources,
   }),
   timeouts:: {
     '#new':: d.fn(help='\n`google.access_context_manager_access_level_condition.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -87,6 +91,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       delete: delete,
     }),
   },
+  vpc_network_sources:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_access_level_condition.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new](#fn-vpc_network_sourcesvpc_subnetworknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vpc_network_sources` sub block.\n', args=[]),
+    new(
+      vpc_subnetwork=null
+    ):: std.prune(a={
+      vpc_subnetwork: vpc_subnetwork,
+    }),
+    vpc_subnetwork:: {
+      '#new':: d.fn(help='\n`google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.\n  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_subnetwork` sub block.\n', args=[]),
+      new(
+        network,
+        vpc_ip_subnetworks=null
+      ):: std.prune(a={
+        network: network,
+        vpc_ip_subnetworks: vpc_ip_subnetworks,
+      }),
+    },
+  },
   '#withAccessLevel':: d.fn(help='`google.string.withAccessLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the access_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `access_level` field.\n', args=[]),
   withAccessLevel(resourceLabel, value): {
     resource+: {
@@ -187,4 +209,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withVpcNetworkSources':: d.fn(help='`google.list[obj].withVpcNetworkSources` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_network_sources field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVpcNetworkSourcesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.\n', args=[]),
+  withVpcNetworkSources(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_access_level_condition+: {
+        [resourceLabel]+: {
+          vpc_network_sources: value,
+        },
+      },
+    },
+  },
+  '#withVpcNetworkSourcesMixin':: d.fn(help='`google.list[obj].withVpcNetworkSourcesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_network_sources field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVpcNetworkSources](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.\n', args=[]),
+  withVpcNetworkSourcesMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_access_level_condition+: {
+        [resourceLabel]+: {
+          vpc_network_sources+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/access_context_manager_access_levels.libsonnet b/4.x/_gen/resources/access_context_manager_access_levels.libsonnet
index d00bb22b..c38c7217 100644
--- a/4.x/_gen/resources/access_context_manager_access_levels.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_access_levels.libsonnet
@@ -33,14 +33,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             }),
           },
         },
-        '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.device_policy.new](#fn-access_levelsaccess_levelsbasicdevice_policynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.device_policy.new](#fn-access_levelsaccess_levelsbasicdevice_policynew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new](#fn-access_levelsaccess_levelsbasicvpc_network_sourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
         new(
           device_policy=null,
           ip_subnetworks=null,
           members=null,
           negate=null,
           regions=null,
-          required_access_levels=null
+          required_access_levels=null,
+          vpc_network_sources=null
         ):: std.prune(a={
           device_policy: device_policy,
           ip_subnetworks: ip_subnetworks,
@@ -48,7 +49,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           negate: negate,
           regions: regions,
           required_access_levels: required_access_levels,
+          vpc_network_sources: vpc_network_sources,
         }),
+        vpc_network_sources:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-access_levelsaccess_levelsbasicconditionsvpc_subnetworknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vpc_network_sources` sub block.\n', args=[]),
+          new(
+            vpc_subnetwork=null
+          ):: std.prune(a={
+            vpc_subnetwork: vpc_subnetwork,
+          }),
+          vpc_subnetwork:: {
+            '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.\n  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_subnetwork` sub block.\n', args=[]),
+            new(
+              network,
+              vpc_ip_subnetworks=null
+            ):: std.prune(a={
+              network: network,
+              vpc_ip_subnetworks: vpc_ip_subnetworks,
+            }),
+          },
+        },
       },
       '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.new` constructs a new object with attributes and blocks configured for the `basic`\nTerraform sub block.\n\n\n\n**Args**:\n  - `combining_function` (`string`): How the conditions list should be combined to determine if a request\nis granted this AccessLevel. If AND is used, each Condition in\nconditions must be satisfied for the AccessLevel to be applied. If\nOR is used, at least one Condition in conditions must be satisfied\nfor the AccessLevel to be applied. Default value: "AND" Possible values: ["AND", "OR"] When `null`, the `combining_function` field will be omitted from the resulting object.\n  - `conditions` (`list[obj]`): A set of requirements for the AccessLevel to be granted. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.new](#fn-access_levelsaccess_levelsconditionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `basic` sub block.\n', args=[]),
       new(
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet
index bdc6d1b3..a7409d34 100644
--- a/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet
@@ -56,14 +56,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   spec:: {
     egress_policies:: {
       egress_from:: {
-        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new](#fn-specspecegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
         new(
           identities=null,
-          identity_type=null
+          identity_type=null,
+          source_restriction=null,
+          sources=null
         ):: std.prune(a={
           identities: identities,
           identity_type: identity_type,
+          source_restriction: source_restriction,
+          sources: sources,
         }),
+        sources:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+          new(
+            access_level=null
+          ):: std.prune(a={
+            access_level: access_level,
+          }),
+        },
       },
       egress_to:: {
         '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.spec.egress_policies.egress_to.operations.new](#fn-specspecegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
@@ -198,14 +210,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   status:: {
     egress_policies:: {
       egress_from:: {
-        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new](#fn-statusstatusegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
         new(
           identities=null,
-          identity_type=null
+          identity_type=null,
+          source_restriction=null,
+          sources=null
         ):: std.prune(a={
           identities: identities,
           identity_type: identity_type,
+          source_restriction: source_restriction,
+          sources: sources,
         }),
+        sources:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+          new(
+            access_level=null
+          ):: std.prune(a={
+            access_level: access_level,
+          }),
+        },
       },
       egress_to:: {
         '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.status.egress_policies.egress_to.operations.new](#fn-statusstatusegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
index b3f2f3e7..f50cb45c 100644
--- a/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
@@ -3,14 +3,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='access_context_manager_service_perimeter_egress_policy', url='', help='`access_context_manager_service_perimeter_egress_policy` represents the `google_access_context_manager_service_perimeter_egress_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   egress_from:: {
-    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new](#fn-egress_fromsourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
     new(
       identities=null,
-      identity_type=null
+      identity_type=null,
+      source_restriction=null,
+      sources=null
     ):: std.prune(a={
       identities: identities,
       identity_type: identity_type,
+      source_restriction: source_restriction,
+      sources: sources,
     }),
+    sources:: {
+      '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+      new(
+        access_level=null
+      ):: std.prune(a={
+        access_level: access_level,
+      }),
+    },
   },
   egress_to:: {
     '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.new](#fn-egress_tooperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet
index 46c5584b..c257f81c 100644
--- a/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet
@@ -47,14 +47,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     spec:: {
       egress_policies:: {
         egress_from:: {
-          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersspecegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
           new(
             identities=null,
-            identity_type=null
+            identity_type=null,
+            source_restriction=null,
+            sources=null
           ):: std.prune(a={
             identities: identities,
             identity_type: identity_type,
+            source_restriction: source_restriction,
+            sources: sources,
           }),
+          sources:: {
+            '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+            new(
+              access_level=null
+            ):: std.prune(a={
+              access_level: access_level,
+            }),
+          },
         },
         egress_to:: {
           '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_to.operations.new](#fn-service_perimetersservice_perimetersspecegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
@@ -189,14 +201,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     status:: {
       egress_policies:: {
         egress_from:: {
-          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersstatusegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
           new(
             identities=null,
-            identity_type=null
+            identity_type=null,
+            source_restriction=null,
+            sources=null
           ):: std.prune(a={
             identities: identities,
             identity_type: identity_type,
+            source_restriction: source_restriction,
+            sources: sources,
           }),
+          sources:: {
+            '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+            new(
+              access_level=null
+            ):: std.prune(a={
+              access_level: access_level,
+            }),
+          },
         },
         egress_to:: {
           '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_to.operations.new](#fn-service_perimetersservice_perimetersstatusegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/active_directory_domain.libsonnet b/4.x/_gen/resources/active_directory_domain.libsonnet
index 24678f10..e834e123 100644
--- a/4.x/_gen/resources/active_directory_domain.libsonnet
+++ b/4.x/_gen/resources/active_directory_domain.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='active_directory_domain', url='', help='`active_directory_domain` represents the `google_active_directory_domain` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.active_directory_domain.new` injects a new `google_active_directory_domain` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.active_directory_domain.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.active_directory_domain` using the reference:\n\n    $._ref.google_active_directory_domain.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_active_directory_domain.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.active_directory_domain.new` injects a new `google_active_directory_domain` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.active_directory_domain.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.active_directory_domain` using the reference:\n\n    $._ref.google_active_directory_domain.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_active_directory_domain.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     domain_name,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.active_directory_domain.newAttrs` constructs a new object with attributes and blocks configured for the `active_directory_domain`\nTerraform resource.\n\nUnlike [google.active_directory_domain.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `active_directory_domain` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.active_directory_domain.newAttrs` constructs a new object with attributes and blocks configured for the `active_directory_domain`\nTerraform resource.\n\nUnlike [google.active_directory_domain.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `active_directory_domain` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     domain_name,
     locations,
diff --git a/4.x/_gen/resources/alloydb_backup.libsonnet b/4.x/_gen/resources/alloydb_backup.libsonnet
index cb2f5002..27b7d57c 100644
--- a/4.x/_gen/resources/alloydb_backup.libsonnet
+++ b/4.x/_gen/resources/alloydb_backup.libsonnet
@@ -10,52 +10,64 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.alloydb_backup.new` injects a new `google_alloydb_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_backup` using the reference:\n\n    $._ref.google_alloydb_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.alloydb_backup.new` injects a new `google_alloydb_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_backup` using the reference:\n\n    $._ref.google_alloydb_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;ON_DEMAND\u0026#34;, \u0026#34;AUTOMATED\u0026#34;, \u0026#34;CONTINUOUS\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backup_id,
     cluster_name,
     location,
+    annotations=null,
     description=null,
+    display_name=null,
     encryption_config=null,
     labels=null,
     project=null,
     timeouts=null,
+    type=null,
     _meta={}
   ):: tf.withResource(
     type='google_alloydb_backup',
     label=resourceLabel,
     attrs=self.newAttrs(
+      annotations=annotations,
       backup_id=backup_id,
       cluster_name=cluster_name,
       description=description,
+      display_name=display_name,
       encryption_config=encryption_config,
       labels=labels,
       location=location,
       project=project,
-      timeouts=timeouts
+      timeouts=timeouts,
+      type=type
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.alloydb_backup.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_backup`\nTerraform resource.\n\nUnlike [google.alloydb_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_backup` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_backup.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_backup`\nTerraform resource.\n\nUnlike [google.alloydb_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: ["TYPE_UNSPECIFIED", "ON_DEMAND", "AUTOMATED", "CONTINUOUS"] When `null`, the `type` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_backup` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backup_id,
     cluster_name,
     location,
+    annotations=null,
     description=null,
+    display_name=null,
     encryption_config=null,
     labels=null,
     project=null,
-    timeouts=null
+    timeouts=null,
+    type=null
   ):: std.prune(a={
+    annotations: annotations,
     backup_id: backup_id,
     cluster_name: cluster_name,
     description: description,
+    display_name: display_name,
     encryption_config: encryption_config,
     labels: labels,
     location: location,
     project: project,
     timeouts: timeouts,
+    type: type,
   }),
   timeouts:: {
     '#new':: d.fn(help='\n`google.alloydb_backup.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -69,6 +81,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_alloydb_backup+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
   '#withBackupId':: d.fn(help='`google.string.withBackupId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the backup_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backup_id` field.\n', args=[]),
   withBackupId(resourceLabel, value): {
     resource+: {
@@ -99,6 +121,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_alloydb_backup+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
   '#withEncryptionConfig':: d.fn(help='`google.list[obj].withEncryptionConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the encryption_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEncryptionConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `encryption_config` field.\n', args=[]),
   withEncryptionConfig(resourceLabel, value): {
     resource+: {
@@ -169,4 +201,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_alloydb_backup+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/alloydb_cluster.libsonnet b/4.x/_gen/resources/alloydb_cluster.libsonnet
index 5f1bd7ff..c01d5a50 100644
--- a/4.x/_gen/resources/alloydb_cluster.libsonnet
+++ b/4.x/_gen/resources/alloydb_cluster.libsonnet
@@ -120,15 +120,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       network: network,
     }),
   },
-  '#new':: d.fn(help="\n`google.alloydb_cluster.new` injects a new `google_alloydb_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_cluster` using the reference:\n\n    $._ref.google_alloydb_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with \u0026#39;restore_continuous_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with \u0026#39;restore_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.alloydb_cluster.new` injects a new `google_alloydb_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_cluster` using the reference:\n\n    $._ref.google_alloydb_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: \u0026#34;PRIMARY\u0026#34; Possible values: [\u0026#34;PRIMARY\u0026#34;, \u0026#34;SECONDARY\u0026#34;] When `null`, the `cluster_type` field will be omitted from the resulting object.\n  - `database_version` (`string`): The database engine major version. This is an optional field and it\u0026#39;s populated at the Cluster creation time. This field cannot be changed after cluster creation. When `null`, the `database_version` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.\nDeleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.\nDeleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = \u0026#34;FORCE\u0026#34; otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with \u0026#39;restore_continuous_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with \u0026#39;restore_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster_id,
     location,
+    annotations=null,
     automated_backup_policy=null,
+    cluster_type=null,
     continuous_backup_config=null,
+    database_version=null,
+    deletion_policy=null,
     display_name=null,
     encryption_config=null,
+    etag=null,
     initial_user=null,
     labels=null,
     network=null,
@@ -136,17 +141,23 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     restore_backup_source=null,
     restore_continuous_backup_source=null,
+    secondary_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
     type='google_alloydb_cluster',
     label=resourceLabel,
     attrs=self.newAttrs(
+      annotations=annotations,
       automated_backup_policy=automated_backup_policy,
       cluster_id=cluster_id,
+      cluster_type=cluster_type,
       continuous_backup_config=continuous_backup_config,
+      database_version=database_version,
+      deletion_policy=deletion_policy,
       display_name=display_name,
       encryption_config=encryption_config,
+      etag=etag,
       initial_user=initial_user,
       labels=labels,
       location=location,
@@ -155,18 +166,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       restore_backup_source=restore_backup_source,
       restore_continuous_backup_source=restore_continuous_backup_source,
+      secondary_config=secondary_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.alloydb_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_cluster`\nTerraform resource.\n\nUnlike [google.alloydb_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_cluster`\nTerraform resource.\n\nUnlike [google.alloydb_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: "PRIMARY" Possible values: ["PRIMARY", "SECONDARY"] When `null`, the `cluster_type` field will be omitted from the resulting object.\n  - `database_version` (`string`): The database engine major version. This is an optional field and it's populated at the Cluster creation time. This field cannot be changed after cluster creation. When `null`, the `database_version` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.\nDeleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.\nDeleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster_id,
     location,
+    annotations=null,
     automated_backup_policy=null,
+    cluster_type=null,
     continuous_backup_config=null,
+    database_version=null,
+    deletion_policy=null,
     display_name=null,
     encryption_config=null,
+    etag=null,
     initial_user=null,
     labels=null,
     network=null,
@@ -174,13 +191,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     restore_backup_source=null,
     restore_continuous_backup_source=null,
+    secondary_config=null,
     timeouts=null
   ):: std.prune(a={
+    annotations: annotations,
     automated_backup_policy: automated_backup_policy,
     cluster_id: cluster_id,
+    cluster_type: cluster_type,
     continuous_backup_config: continuous_backup_config,
+    database_version: database_version,
+    deletion_policy: deletion_policy,
     display_name: display_name,
     encryption_config: encryption_config,
+    etag: etag,
     initial_user: initial_user,
     labels: labels,
     location: location,
@@ -189,6 +212,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     restore_backup_source: restore_backup_source,
     restore_continuous_backup_source: restore_continuous_backup_source,
+    secondary_config: secondary_config,
     timeouts: timeouts,
   }),
   restore_backup_source:: {
@@ -209,6 +233,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       point_in_time: point_in_time,
     }),
   },
+  secondary_config:: {
+    '#new':: d.fn(help='\n`google.alloydb_cluster.secondary_config.new` constructs a new object with attributes and blocks configured for the `secondary_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `primary_cluster_name` (`string`): Name of the primary cluster must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n\n**Returns**:\n  - An attribute object that represents the `secondary_config` sub block.\n', args=[]),
+    new(
+      primary_cluster_name
+    ):: std.prune(a={
+      primary_cluster_name: primary_cluster_name,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.alloydb_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -221,6 +253,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
   '#withAutomatedBackupPolicy':: d.fn(help='`google.list[obj].withAutomatedBackupPolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the automated_backup_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAutomatedBackupPolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `automated_backup_policy` field.\n', args=[]),
   withAutomatedBackupPolicy(resourceLabel, value): {
     resource+: {
@@ -251,6 +293,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withClusterType':: d.fn(help='`google.string.withClusterType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster_type` field.\n', args=[]),
+  withClusterType(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          cluster_type: value,
+        },
+      },
+    },
+  },
   '#withContinuousBackupConfig':: d.fn(help='`google.list[obj].withContinuousBackupConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the continuous_backup_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withContinuousBackupConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `continuous_backup_config` field.\n', args=[]),
   withContinuousBackupConfig(resourceLabel, value): {
     resource+: {
@@ -271,6 +323,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDatabaseVersion':: d.fn(help='`google.string.withDatabaseVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the database_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `database_version` field.\n', args=[]),
+  withDatabaseVersion(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          database_version: value,
+        },
+      },
+    },
+  },
+  '#withDeletionPolicy':: d.fn(help='`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deletion_policy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deletion_policy` field.\n', args=[]),
+  withDeletionPolicy(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          deletion_policy: value,
+        },
+      },
+    },
+  },
   '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
   withDisplayName(resourceLabel, value): {
     resource+: {
@@ -301,6 +373,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEtag':: d.fn(help='`google.string.withEtag` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the etag field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `etag` field.\n', args=[]),
+  withEtag(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          etag: value,
+        },
+      },
+    },
+  },
   '#withInitialUser':: d.fn(help='`google.list[obj].withInitialUser` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the initial_user field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withInitialUserMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `initial_user` field.\n', args=[]),
   withInitialUser(resourceLabel, value): {
     resource+: {
@@ -421,6 +503,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSecondaryConfig':: d.fn(help='`google.list[obj].withSecondaryConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the secondary_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSecondaryConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `secondary_config` field.\n', args=[]),
+  withSecondaryConfig(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          secondary_config: value,
+        },
+      },
+    },
+  },
+  '#withSecondaryConfigMixin':: d.fn(help='`google.list[obj].withSecondaryConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the secondary_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSecondaryConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `secondary_config` field.\n', args=[]),
+  withSecondaryConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          secondary_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/alloydb_instance.libsonnet b/4.x/_gen/resources/alloydb_instance.libsonnet
index 84ec8f08..e91d8023 100644
--- a/4.x/_gen/resources/alloydb_instance.libsonnet
+++ b/4.x/_gen/resources/alloydb_instance.libsonnet
@@ -2,6 +2,24 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='alloydb_instance', url='', help='`alloydb_instance` represents the `google_alloydb_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  client_connection_config:: {
+    '#new':: d.fn(help='\n`google.alloydb_instance.client_connection_config.new` constructs a new object with attributes and blocks configured for the `client_connection_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `require_connectors` (`bool`): Configuration to enforce connectors only (ex: AuthProxy) connections to the database. When `null`, the `require_connectors` field will be omitted from the resulting object.\n  - `ssl_config` (`list[obj]`): SSL config option for this instance. When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.ssl_config.new](#fn-client_connection_configssl_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `client_connection_config` sub block.\n', args=[]),
+    new(
+      require_connectors=null,
+      ssl_config=null
+    ):: std.prune(a={
+      require_connectors: require_connectors,
+      ssl_config: ssl_config,
+    }),
+    ssl_config:: {
+      '#new':: d.fn(help='\n`google.alloydb_instance.client_connection_config.ssl_config.new` constructs a new object with attributes and blocks configured for the `ssl_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ssl_mode` (`string`): SSL mode. Specifies client-server SSL/TLS connection behavior. Possible values: ["ENCRYPTED_ONLY", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"] When `null`, the `ssl_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ssl_config` sub block.\n', args=[]),
+      new(
+        ssl_mode=null
+      ):: std.prune(a={
+        ssl_mode: ssl_mode,
+      }),
+    },
+  },
   machine_config:: {
     '#new':: d.fn(help='\n`google.alloydb_instance.machine_config.new` constructs a new object with attributes and blocks configured for the `machine_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu_count` (`number`): The number of CPU's in the VM instance. When `null`, the `cpu_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `machine_config` sub block.\n', args=[]),
     new(
@@ -10,7 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cpu_count: cpu_count,
     }),
   },
-  '#new':: d.fn(help="\n`google.alloydb_instance.new` injects a new `google_alloydb_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_instance` using the reference:\n\n    $._ref.google_alloydb_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): \u0026#39;Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can\u0026#39;t specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).\u0026#39; Possible values: [\u0026#34;AVAILABILITY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;ZONAL\u0026#34;, \u0026#34;REGIONAL\u0026#34;] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/clusters/{cluster_id}\u0026#39;\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the \u0026#39;depends_on\u0026#39; meta-data attribute. Possible values: [\u0026#34;PRIMARY\u0026#34;, \u0026#34;READ_POOL\u0026#34;]\n  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.alloydb_instance.new` injects a new `google_alloydb_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_instance` using the reference:\n\n    $._ref.google_alloydb_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): \u0026#39;Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can\u0026#39;t specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).\u0026#39; Possible values: [\u0026#34;AVAILABILITY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;ZONAL\u0026#34;, \u0026#34;REGIONAL\u0026#34;] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/clusters/{cluster_id}\u0026#39;\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance.\nIf the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the \u0026#39;depends_on\u0026#39; meta-data attribute.\nIf the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.\nExample: {instance_type = google_alloydb_cluster.\u0026lt;secondary_cluster_name\u0026gt;.cluster_type} instead of {instance_type = SECONDARY}\nIf the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.\nUse deletion_policy = \u0026#34;FORCE\u0026#34; in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.\nUsers can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: [\u0026#34;PRIMARY\u0026#34;, \u0026#34;READ_POOL\u0026#34;, \u0026#34;SECONDARY\u0026#34;]\n  - `labels` (`obj`): User-defined labels for the alloydb instance.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -18,11 +36,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     instance_type,
     annotations=null,
     availability_type=null,
+    client_connection_config=null,
     database_flags=null,
     display_name=null,
     gce_zone=null,
     labels=null,
     machine_config=null,
+    query_insights_config=null,
     read_pool_config=null,
     timeouts=null,
     _meta={}
@@ -32,6 +52,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     attrs=self.newAttrs(
       annotations=annotations,
       availability_type=availability_type,
+      client_connection_config=client_connection_config,
       cluster=cluster,
       database_flags=database_flags,
       display_name=display_name,
@@ -40,28 +61,32 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       instance_type=instance_type,
       labels=labels,
       machine_config=machine_config,
+      query_insights_config=query_insights_config,
       read_pool_config=read_pool_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.alloydb_instance.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_instance`\nTerraform resource.\n\nUnlike [google.alloydb_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).' Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the 'depends_on' meta-data attribute. Possible values: ["PRIMARY", "READ_POOL"]\n  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_instance.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_instance`\nTerraform resource.\n\nUnlike [google.alloydb_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).' Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance.\nIf the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the 'depends_on' meta-data attribute.\nIf the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.\nExample: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}\nIf the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.\nUse deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.\nUsers can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]\n  - `labels` (`obj`): User-defined labels for the alloydb instance.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     instance_id,
     instance_type,
     annotations=null,
     availability_type=null,
+    client_connection_config=null,
     database_flags=null,
     display_name=null,
     gce_zone=null,
     labels=null,
     machine_config=null,
+    query_insights_config=null,
     read_pool_config=null,
     timeouts=null
   ):: std.prune(a={
     annotations: annotations,
     availability_type: availability_type,
+    client_connection_config: client_connection_config,
     cluster: cluster,
     database_flags: database_flags,
     display_name: display_name,
@@ -70,9 +95,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     instance_type: instance_type,
     labels: labels,
     machine_config: machine_config,
+    query_insights_config: query_insights_config,
     read_pool_config: read_pool_config,
     timeouts: timeouts,
   }),
+  query_insights_config:: {
+    '#new':: d.fn(help='\n`google.alloydb_instance.query_insights_config.new` constructs a new object with attributes and blocks configured for the `query_insights_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `query_plans_per_minute` (`number`): Number of query execution plans captured by Insights per minute for all queries combined. The default value is 5. Any integer between 0 and 20 is considered valid. When `null`, the `query_plans_per_minute` field will be omitted from the resulting object.\n  - `query_string_length` (`number`): Query string length. The default value is 1024. Any integer between 256 and 4500 is considered valid. When `null`, the `query_string_length` field will be omitted from the resulting object.\n  - `record_application_tags` (`bool`): Record application tags for an instance. This flag is turned "on" by default. When `null`, the `record_application_tags` field will be omitted from the resulting object.\n  - `record_client_address` (`bool`): Record client address for an instance. Client address is PII information. This flag is turned "on" by default. When `null`, the `record_client_address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `query_insights_config` sub block.\n', args=[]),
+    new(
+      query_plans_per_minute=null,
+      query_string_length=null,
+      record_application_tags=null,
+      record_client_address=null
+    ):: std.prune(a={
+      query_plans_per_minute: query_plans_per_minute,
+      query_string_length: query_string_length,
+      record_application_tags: record_application_tags,
+      record_client_address: record_client_address,
+    }),
+  },
   read_pool_config:: {
     '#new':: d.fn(help='\n`google.alloydb_instance.read_pool_config.new` constructs a new object with attributes and blocks configured for the `read_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_count` (`number`): Read capacity, i.e. number of nodes in a read pool instance. When `null`, the `node_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `read_pool_config` sub block.\n', args=[]),
     new(
@@ -113,6 +153,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withClientConnectionConfig':: d.fn(help='`google.list[obj].withClientConnectionConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the client_connection_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withClientConnectionConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.\n', args=[]),
+  withClientConnectionConfig(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          client_connection_config: value,
+        },
+      },
+    },
+  },
+  '#withClientConnectionConfigMixin':: d.fn(help='`google.list[obj].withClientConnectionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the client_connection_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withClientConnectionConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.\n', args=[]),
+  withClientConnectionConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          client_connection_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
   withCluster(resourceLabel, value): {
     resource+: {
@@ -203,6 +263,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withQueryInsightsConfig':: d.fn(help='`google.list[obj].withQueryInsightsConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the query_insights_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withQueryInsightsConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.\n', args=[]),
+  withQueryInsightsConfig(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          query_insights_config: value,
+        },
+      },
+    },
+  },
+  '#withQueryInsightsConfigMixin':: d.fn(help='`google.list[obj].withQueryInsightsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the query_insights_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withQueryInsightsConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.\n', args=[]),
+  withQueryInsightsConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          query_insights_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withReadPoolConfig':: d.fn(help='`google.list[obj].withReadPoolConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the read_pool_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withReadPoolConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `read_pool_config` field.\n', args=[]),
   withReadPoolConfig(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/alloydb_user.libsonnet b/4.x/_gen/resources/alloydb_user.libsonnet
new file mode 100644
index 00000000..5affc7a2
--- /dev/null
+++ b/4.x/_gen/resources/alloydb_user.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='alloydb_user', url='', help='`alloydb_user` represents the `google_alloydb_user` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.alloydb_user.new` injects a new `google_alloydb_user` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_user.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_user` using the reference:\n\n    $._ref.google_alloydb_user.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_user.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/clusters/{cluster_id}\u0026#39;\n  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.\n  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.\n  - `user_id` (`string`): The database role name of the user.\n  - `user_type` (`string`): The type of this user. Possible values: [\u0026#34;ALLOYDB_BUILT_IN\u0026#34;, \u0026#34;ALLOYDB_IAM_USER\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cluster,
+    user_id,
+    user_type,
+    database_roles=null,
+    password=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_alloydb_user',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cluster=cluster,
+      database_roles=database_roles,
+      password=password,
+      timeouts=timeouts,
+      user_id=user_id,
+      user_type=user_type
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_user.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_user`\nTerraform resource.\n\nUnlike [google.alloydb_user.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.\n  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.\n  - `user_id` (`string`): The database role name of the user.\n  - `user_type` (`string`): The type of this user. Possible values: ["ALLOYDB_BUILT_IN", "ALLOYDB_IAM_USER"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_user` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cluster,
+    user_id,
+    user_type,
+    database_roles=null,
+    password=null,
+    timeouts=null
+  ):: std.prune(a={
+    cluster: cluster,
+    database_roles: database_roles,
+    password: password,
+    timeouts: timeouts,
+    user_id: user_id,
+    user_type: user_type,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.alloydb_user.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
+  withCluster(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          cluster: value,
+        },
+      },
+    },
+  },
+  '#withDatabaseRoles':: d.fn(help='`google.list.withDatabaseRoles` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the database_roles field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `database_roles` field.\n', args=[]),
+  withDatabaseRoles(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          database_roles: value,
+        },
+      },
+    },
+  },
+  '#withPassword':: d.fn(help='`google.string.withPassword` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the password field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `password` field.\n', args=[]),
+  withPassword(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          password: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUserId':: d.fn(help='`google.string.withUserId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the user_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `user_id` field.\n', args=[]),
+  withUserId(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          user_id: value,
+        },
+      },
+    },
+  },
+  '#withUserType':: d.fn(help='`google.string.withUserType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the user_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `user_type` field.\n', args=[]),
+  withUserType(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          user_type: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/apigee_environment.libsonnet b/4.x/_gen/resources/apigee_environment.libsonnet
index 831dc33a..31ae5b3a 100644
--- a/4.x/_gen/resources/apigee_environment.libsonnet
+++ b/4.x/_gen/resources/apigee_environment.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='apigee_environment', url='', help='`apigee_environment` represents the `google_apigee_environment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.apigee_environment.new` injects a new `google_apigee_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.apigee_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.apigee_environment` using the reference:\n\n    $._ref.google_apigee_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_apigee_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: [\u0026#34;API_PROXY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROGRAMMABLE\u0026#34;, \u0026#34;CONFIGURABLE\u0026#34;] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: [\u0026#34;DEPLOYMENT_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROXY\u0026#34;, \u0026#34;ARCHIVE\u0026#34;] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format \u0026#39;organizations/{{org_name}}\u0026#39;.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.apigee_environment.new` injects a new `google_apigee_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.apigee_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.apigee_environment` using the reference:\n\n    $._ref.google_apigee_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_apigee_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: [\u0026#34;API_PROXY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROGRAMMABLE\u0026#34;, \u0026#34;CONFIGURABLE\u0026#34;] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: [\u0026#34;DEPLOYMENT_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROXY\u0026#34;, \u0026#34;ARCHIVE\u0026#34;] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format \u0026#39;organizations/{{org_name}}\u0026#39;.\n  - `type` (`string`): Types that can be selected for an Environment. Each of the types are\nlimited by capability and capacity. Refer to Apigee\u0026#39;s public documentation\nto understand about each of these types in details.\nAn Apigee org can support heterogeneous Environments. Possible values: [\u0026#34;ENVIRONMENT_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;BASE\u0026#34;, \u0026#34;INTERMEDIATE\u0026#34;, \u0026#34;COMPREHENSIVE\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -13,6 +13,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name=null,
     node_config=null,
     timeouts=null,
+    type=null,
     _meta={}
   ):: tf.withResource(
     type='google_apigee_environment',
@@ -25,11 +26,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name=name,
       node_config=node_config,
       org_id=org_id,
-      timeouts=timeouts
+      timeouts=timeouts,
+      type=type
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.apigee_environment.newAttrs` constructs a new object with attributes and blocks configured for the `apigee_environment`\nTerraform resource.\n\nUnlike [google.apigee_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: ["API_PROXY_TYPE_UNSPECIFIED", "PROGRAMMABLE", "CONFIGURABLE"] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: ["DEPLOYMENT_TYPE_UNSPECIFIED", "PROXY", "ARCHIVE"] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format 'organizations/{{org_name}}'.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `apigee_environment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.apigee_environment.newAttrs` constructs a new object with attributes and blocks configured for the `apigee_environment`\nTerraform resource.\n\nUnlike [google.apigee_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: ["API_PROXY_TYPE_UNSPECIFIED", "PROGRAMMABLE", "CONFIGURABLE"] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: ["DEPLOYMENT_TYPE_UNSPECIFIED", "PROXY", "ARCHIVE"] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format 'organizations/{{org_name}}'.\n  - `type` (`string`): Types that can be selected for an Environment. Each of the types are\nlimited by capability and capacity. Refer to Apigee's public documentation\nto understand about each of these types in details.\nAn Apigee org can support heterogeneous Environments. Possible values: ["ENVIRONMENT_TYPE_UNSPECIFIED", "BASE", "INTERMEDIATE", "COMPREHENSIVE"] When `null`, the `type` field will be omitted from the resulting object.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `apigee_environment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     org_id,
@@ -38,7 +40,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description=null,
     display_name=null,
     node_config=null,
-    timeouts=null
+    timeouts=null,
+    type=null
   ):: std.prune(a={
     api_proxy_type: api_proxy_type,
     deployment_type: deployment_type,
@@ -48,6 +51,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_config: node_config,
     org_id: org_id,
     timeouts: timeouts,
+    type: type,
   }),
   node_config:: {
     '#new':: d.fn(help='\n`google.apigee_environment.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_node_count` (`string`): The maximum total number of gateway nodes that the is reserved for all instances that\nhas the specified environment. If not specified, the default is determined by the\nrecommended maximum number of nodes for that gateway. When `null`, the `max_node_count` field will be omitted from the resulting object.\n  - `min_node_count` (`string`): The minimum total number of gateway nodes that the is reserved for all instances that\nhas the specified environment. If not specified, the default is determined by the\nrecommended minimum number of nodes for that gateway. When `null`, the `min_node_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
@@ -171,4 +175,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_apigee_environment+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/artifact_registry_repository.libsonnet b/4.x/_gen/resources/artifact_registry_repository.libsonnet
index 283fb4eb..34a67e04 100644
--- a/4.x/_gen/resources/artifact_registry_repository.libsonnet
+++ b/4.x/_gen/resources/artifact_registry_repository.libsonnet
@@ -2,6 +2,46 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='artifact_registry_repository', url='', help='`artifact_registry_repository` represents the `google_artifact_registry_repository` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  cleanup_policies:: {
+    condition:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.cleanup_policies.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `newer_than` (`string`): Match versions newer than a duration. When `null`, the `newer_than` field will be omitted from the resulting object.\n  - `older_than` (`string`): Match versions older than a duration. When `null`, the `older_than` field will be omitted from the resulting object.\n  - `package_name_prefixes` (`list`): Match versions by package prefix. Applied on any prefix match. When `null`, the `package_name_prefixes` field will be omitted from the resulting object.\n  - `tag_prefixes` (`list`): Match versions by tag prefix. Applied on any prefix match. When `null`, the `tag_prefixes` field will be omitted from the resulting object.\n  - `tag_state` (`string`): Match versions by tag status. Default value: "ANY" Possible values: ["TAGGED", "UNTAGGED", "ANY"] When `null`, the `tag_state` field will be omitted from the resulting object.\n  - `version_name_prefixes` (`list`): Match versions by version name prefix. Applied on any prefix match. When `null`, the `version_name_prefixes` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+      new(
+        newer_than=null,
+        older_than=null,
+        package_name_prefixes=null,
+        tag_prefixes=null,
+        tag_state=null,
+        version_name_prefixes=null
+      ):: std.prune(a={
+        newer_than: newer_than,
+        older_than: older_than,
+        package_name_prefixes: package_name_prefixes,
+        tag_prefixes: tag_prefixes,
+        tag_state: tag_state,
+        version_name_prefixes: version_name_prefixes,
+      }),
+    },
+    most_recent_versions:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.cleanup_policies.most_recent_versions.new` constructs a new object with attributes and blocks configured for the `most_recent_versions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `keep_count` (`number`): Minimum number of versions to keep. When `null`, the `keep_count` field will be omitted from the resulting object.\n  - `package_name_prefixes` (`list`): Match versions by package prefix. Applied on any prefix match. When `null`, the `package_name_prefixes` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `most_recent_versions` sub block.\n', args=[]),
+      new(
+        keep_count=null,
+        package_name_prefixes=null
+      ):: std.prune(a={
+        keep_count: keep_count,
+        package_name_prefixes: package_name_prefixes,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.artifact_registry_repository.cleanup_policies.new` constructs a new object with attributes and blocks configured for the `cleanup_policies`\nTerraform sub block.\n\n\n\n**Args**:\n  - `action` (`string`): Policy action. Possible values: ["DELETE", "KEEP"] When `null`, the `action` field will be omitted from the resulting object.\n  - `condition` (`list[obj]`): Policy condition for matching versions. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.condition.new](#fn-cleanup_policiesconditionnew) constructor.\n  - `most_recent_versions` (`list[obj]`): Policy condition for retaining a minimum number of versions. May only be\nspecified with a Keep action. When `null`, the `most_recent_versions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.most_recent_versions.new](#fn-cleanup_policiesmost_recent_versionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cleanup_policies` sub block.\n', args=[]),
+    new(
+      action=null,
+      condition=null,
+      most_recent_versions=null
+    ):: std.prune(a={
+      action: action,
+      condition: condition,
+      most_recent_versions: most_recent_versions,
+    }),
+  },
   docker_config:: {
     '#new':: d.fn(help='\n`google.artifact_registry_repository.docker_config.new` constructs a new object with attributes and blocks configured for the `docker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `immutable_tags` (`bool`): The repository which enabled this flag prevents all tags from being modified, moved or deleted. This does not prevent tags from being created. When `null`, the `immutable_tags` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `docker_config` sub block.\n', args=[]),
     new(
@@ -20,11 +60,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       version_policy: version_policy,
     }),
   },
-  '#new':: d.fn(help="\n`google.artifact_registry_repository.new` injects a new `google_artifact_registry_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.artifact_registry_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.artifact_registry_repository` using the reference:\n\n    $._ref.google_artifact_registry_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_artifact_registry_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n\u0026#39;projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key\u0026#39;.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: \u0026#34;STANDARD_REPOSITORY\u0026#34; Possible values: [\u0026#34;STANDARD_REPOSITORY\u0026#34;, \u0026#34;VIRTUAL_REPOSITORY\u0026#34;, \u0026#34;REMOTE_REPOSITORY\u0026#34;] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n\u0026#34;repo1\u0026#34;\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.artifact_registry_repository.new` injects a new `google_artifact_registry_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.artifact_registry_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.artifact_registry_repository` using the reference:\n\n    $._ref.google_artifact_registry_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_artifact_registry_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cleanup_policy_dry_run` (`bool`): If true, the cleanup pipeline is prevented from deleting versions in this\nrepository. When `null`, the `cleanup_policy_dry_run` field will be omitted from the resulting object.\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n\u0026#39;projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key\u0026#39;.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: \u0026#34;STANDARD_REPOSITORY\u0026#34; Possible values: [\u0026#34;STANDARD_REPOSITORY\u0026#34;, \u0026#34;VIRTUAL_REPOSITORY\u0026#34;, \u0026#34;REMOTE_REPOSITORY\u0026#34;] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n\u0026#34;repo1\u0026#34;\n  - `cleanup_policies` (`list[obj]`): Cleanup policies for this repository. Cleanup policies indicate when\ncertain package versions can be automatically deleted.\nMap keys are policy IDs supplied by users during policy creation. They must\nunique within a repository and be under 128 characters in length. When `null`, the `cleanup_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.new](#fn-cleanup_policiesnew) constructor.\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     format,
     repository_id,
+    cleanup_policies=null,
+    cleanup_policy_dry_run=null,
     description=null,
     docker_config=null,
     kms_key_name=null,
@@ -41,6 +83,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_artifact_registry_repository',
     label=resourceLabel,
     attrs=self.newAttrs(
+      cleanup_policies=cleanup_policies,
+      cleanup_policy_dry_run=cleanup_policy_dry_run,
       description=description,
       docker_config=docker_config,
       format=format,
@@ -57,10 +101,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.artifact_registry_repository.newAttrs` constructs a new object with attributes and blocks configured for the `artifact_registry_repository`\nTerraform resource.\n\nUnlike [google.artifact_registry_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n'projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key'.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n"repo1"\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `artifact_registry_repository` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.artifact_registry_repository.newAttrs` constructs a new object with attributes and blocks configured for the `artifact_registry_repository`\nTerraform resource.\n\nUnlike [google.artifact_registry_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cleanup_policy_dry_run` (`bool`): If true, the cleanup pipeline is prevented from deleting versions in this\nrepository. When `null`, the `cleanup_policy_dry_run` field will be omitted from the resulting object.\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n'projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key'.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n"repo1"\n  - `cleanup_policies` (`list[obj]`): Cleanup policies for this repository. Cleanup policies indicate when\ncertain package versions can be automatically deleted.\nMap keys are policy IDs supplied by users during policy creation. They must\nunique within a repository and be under 128 characters in length. When `null`, the `cleanup_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.new](#fn-cleanup_policiesnew) constructor.\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `artifact_registry_repository` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     format,
     repository_id,
+    cleanup_policies=null,
+    cleanup_policy_dry_run=null,
     description=null,
     docker_config=null,
     kms_key_name=null,
@@ -73,6 +119,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts=null,
     virtual_repository_config=null
   ):: std.prune(a={
+    cleanup_policies: cleanup_policies,
+    cleanup_policy_dry_run: cleanup_policy_dry_run,
     description: description,
     docker_config: docker_config,
     format: format,
@@ -88,6 +136,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     virtual_repository_config: virtual_repository_config,
   }),
   remote_repository_config:: {
+    apt_repository:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.apt_repository.new` constructs a new object with attributes and blocks configured for the `apt_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`list[obj]`): One of the publicly available Apt repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `apt_repository` sub block.\n', args=[]),
+      new(
+        public_repository=null
+      ):: std.prune(a={
+        public_repository: public_repository,
+      }),
+      public_repository:: {
+        '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `repository_base` (`string`): A common public repository base for Apt, e.g. '"debian/dists/buster"' Possible values: ["DEBIAN", "UBUNTU"]\n  - `repository_path` (`string`): Specific repository from the base.\n\n**Returns**:\n  - An attribute object that represents the `public_repository` sub block.\n', args=[]),
+        new(
+          repository_base,
+          repository_path
+        ):: std.prune(a={
+          repository_base: repository_base,
+          repository_path: repository_path,
+        }),
+      },
+    },
     docker_repository:: {
       '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.docker_repository.new` constructs a new object with attributes and blocks configured for the `docker_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`string`): Address of the remote repository. Default value: "DOCKER_HUB" Possible values: ["DOCKER_HUB"] When `null`, the `public_repository` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `docker_repository` sub block.\n', args=[]),
       new(
@@ -104,19 +170,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         public_repository: public_repository,
       }),
     },
-    '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.new` constructs a new object with attributes and blocks configured for the `remote_repository_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): The description of the remote source. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_repository` (`list[obj]`): Specific settings for a Docker remote repository. When `null`, the `docker_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.docker_repository.new](#fn-remote_repository_configdocker_repositorynew) constructor.\n  - `maven_repository` (`list[obj]`): Specific settings for a Maven remote repository. When `null`, the `maven_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.maven_repository.new](#fn-remote_repository_configmaven_repositorynew) constructor.\n  - `npm_repository` (`list[obj]`): Specific settings for an Npm remote repository. When `null`, the `npm_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.npm_repository.new](#fn-remote_repository_confignpm_repositorynew) constructor.\n  - `python_repository` (`list[obj]`): Specific settings for a Python remote repository. When `null`, the `python_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.python_repository.new](#fn-remote_repository_configpython_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `remote_repository_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.new` constructs a new object with attributes and blocks configured for the `remote_repository_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): The description of the remote source. When `null`, the `description` field will be omitted from the resulting object.\n  - `apt_repository` (`list[obj]`): Specific settings for an Apt remote repository. When `null`, the `apt_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.new](#fn-remote_repository_configapt_repositorynew) constructor.\n  - `docker_repository` (`list[obj]`): Specific settings for a Docker remote repository. When `null`, the `docker_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.docker_repository.new](#fn-remote_repository_configdocker_repositorynew) constructor.\n  - `maven_repository` (`list[obj]`): Specific settings for a Maven remote repository. When `null`, the `maven_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.maven_repository.new](#fn-remote_repository_configmaven_repositorynew) constructor.\n  - `npm_repository` (`list[obj]`): Specific settings for an Npm remote repository. When `null`, the `npm_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.npm_repository.new](#fn-remote_repository_confignpm_repositorynew) constructor.\n  - `python_repository` (`list[obj]`): Specific settings for a Python remote repository. When `null`, the `python_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.python_repository.new](#fn-remote_repository_configpython_repositorynew) constructor.\n  - `upstream_credentials` (`list[obj]`): The credentials used to access the remote repository. When `null`, the `upstream_credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.upstream_credentials.new](#fn-remote_repository_configupstream_credentialsnew) constructor.\n  - `yum_repository` (`list[obj]`): Specific settings for an Yum remote repository. When `null`, the `yum_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.new](#fn-remote_repository_configyum_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `remote_repository_config` sub block.\n', args=[]),
     new(
+      apt_repository=null,
       description=null,
       docker_repository=null,
       maven_repository=null,
       npm_repository=null,
-      python_repository=null
+      python_repository=null,
+      upstream_credentials=null,
+      yum_repository=null
     ):: std.prune(a={
+      apt_repository: apt_repository,
       description: description,
       docker_repository: docker_repository,
       maven_repository: maven_repository,
       npm_repository: npm_repository,
       python_repository: python_repository,
+      upstream_credentials: upstream_credentials,
+      yum_repository: yum_repository,
     }),
     npm_repository:: {
       '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.npm_repository.new` constructs a new object with attributes and blocks configured for the `npm_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`string`): Address of the remote repository. Default value: "NPMJS" Possible values: ["NPMJS"] When `null`, the `public_repository` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `npm_repository` sub block.\n', args=[]),
@@ -134,6 +206,42 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         public_repository: public_repository,
       }),
     },
+    upstream_credentials:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.upstream_credentials.new` constructs a new object with attributes and blocks configured for the `upstream_credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username_password_credentials` (`list[obj]`): Use username and password to access the remote repository. When `null`, the `username_password_credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.upstream_credentials.username_password_credentials.new](#fn-remote_repository_configremote_repository_configusername_password_credentialsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `upstream_credentials` sub block.\n', args=[]),
+      new(
+        username_password_credentials=null
+      ):: std.prune(a={
+        username_password_credentials: username_password_credentials,
+      }),
+      username_password_credentials:: {
+        '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.upstream_credentials.username_password_credentials.new` constructs a new object with attributes and blocks configured for the `username_password_credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `password_secret_version` (`string`): The Secret Manager key version that holds the password to access the\nremote repository. Must be in the format of\n'projects/{project}/secrets/{secret}/versions/{version}'. When `null`, the `password_secret_version` field will be omitted from the resulting object.\n  - `username` (`string`): The username to access the remote repository. When `null`, the `username` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `username_password_credentials` sub block.\n', args=[]),
+        new(
+          password_secret_version=null,
+          username=null
+        ):: std.prune(a={
+          password_secret_version: password_secret_version,
+          username: username,
+        }),
+      },
+    },
+    yum_repository:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.yum_repository.new` constructs a new object with attributes and blocks configured for the `yum_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`list[obj]`): One of the publicly available Yum repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `yum_repository` sub block.\n', args=[]),
+      new(
+        public_repository=null
+      ):: std.prune(a={
+        public_repository: public_repository,
+      }),
+      public_repository:: {
+        '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `repository_base` (`string`): A common public repository base for Yum. Possible values: ["CENTOS", "CENTOS_DEBUG", "CENTOS_VAULT", "CENTOS_STREAM", "ROCKY", "EPEL"]\n  - `repository_path` (`string`): Specific repository from the base, e.g. '"centos/8-stream/BaseOS/x86_64/os"'\n\n**Returns**:\n  - An attribute object that represents the `public_repository` sub block.\n', args=[]),
+        new(
+          repository_base,
+          repository_path
+        ):: std.prune(a={
+          repository_base: repository_base,
+          repository_path: repository_path,
+        }),
+      },
+    },
   },
   timeouts:: {
     '#new':: d.fn(help='\n`google.artifact_registry_repository.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -165,6 +273,36 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
+  '#withCleanupPolicies':: d.fn(help='`google.list[obj].withCleanupPolicies` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cleanup_policies field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCleanupPoliciesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cleanup_policies` field.\n', args=[]),
+  withCleanupPolicies(resourceLabel, value): {
+    resource+: {
+      google_artifact_registry_repository+: {
+        [resourceLabel]+: {
+          cleanup_policies: value,
+        },
+      },
+    },
+  },
+  '#withCleanupPoliciesMixin':: d.fn(help='`google.list[obj].withCleanupPoliciesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cleanup_policies field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCleanupPolicies](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cleanup_policies` field.\n', args=[]),
+  withCleanupPoliciesMixin(resourceLabel, value): {
+    resource+: {
+      google_artifact_registry_repository+: {
+        [resourceLabel]+: {
+          cleanup_policies+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withCleanupPolicyDryRun':: d.fn(help='`google.bool.withCleanupPolicyDryRun` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the cleanup_policy_dry_run field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `cleanup_policy_dry_run` field.\n', args=[]),
+  withCleanupPolicyDryRun(resourceLabel, value): {
+    resource+: {
+      google_artifact_registry_repository+: {
+        [resourceLabel]+: {
+          cleanup_policy_dry_run: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/assured_workloads_workload.libsonnet b/4.x/_gen/resources/assured_workloads_workload.libsonnet
index aae94e4e..1dcbfe1d 100644
--- a/4.x/_gen/resources/assured_workloads_workload.libsonnet
+++ b/4.x/_gen/resources/assured_workloads_workload.libsonnet
@@ -12,19 +12,23 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       rotation_period: rotation_period,
     }),
   },
-  '#new':: d.fn(help="\n`google.assured_workloads_workload.new` injects a new `google_assured_workloads_workload` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.assured_workloads_workload.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.assured_workloads_workload` using the reference:\n\n    $._ref.google_assured_workloads_workload.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_assured_workloads_workload.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, \u0026#39;billingAccounts/012345-567890-ABCDEF`.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.assured_workloads_workload.new` injects a new `google_assured_workloads_workload` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.assured_workloads_workload.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.assured_workloads_workload` using the reference:\n\n    $._ref.google_assured_workloads_workload.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_assured_workloads_workload.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): Optional. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, `billingAccounts/012345-567890-ABCDEF`. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, HITRUST, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS, ISR_REGIONS, ISR_REGIONS_AND_SUPPORT, CA_PROTECTED_B, IL5, IL2, JP_REGIONS_AND_SUPPORT\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `enable_sovereign_controls` (`bool`): Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers. When `null`, the `enable_sovereign_controls` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels applied to the workload.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `partner` (`string`): Optional. Partner regime associated with this workload. Possible values: PARTNER_UNSPECIFIED, LOCAL_CONTROLS_BY_S3NS, SOVEREIGN_CONTROLS_BY_T_SYSTEMS, SOVEREIGN_CONTROLS_BY_SIA_MINSAIT, SOVEREIGN_CONTROLS_BY_PSN When `null`, the `partner` field will be omitted from the resulting object.\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `violation_notifications_enabled` (`bool`): Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload. When `null`, the `violation_notifications_enabled` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): **DEPRECATED** Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `partner_permissions` (`list[obj]`): Optional. Permissions granted to the AW Partner SA account for the customer workload When `null`, the `partner_permissions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.partner_permissions.new](#fn-partner_permissionsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
-    billing_account,
     compliance_regime,
     display_name,
     location,
     organization,
+    billing_account=null,
+    enable_sovereign_controls=null,
     kms_settings=null,
     labels=null,
+    partner=null,
+    partner_permissions=null,
     provisioned_resources_parent=null,
     resource_settings=null,
     timeouts=null,
+    violation_notifications_enabled=null,
     _meta={}
   ):: tf.withResource(
     type='google_assured_workloads_workload',
@@ -33,46 +37,72 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       billing_account=billing_account,
       compliance_regime=compliance_regime,
       display_name=display_name,
+      enable_sovereign_controls=enable_sovereign_controls,
       kms_settings=kms_settings,
       labels=labels,
       location=location,
       organization=organization,
+      partner=partner,
+      partner_permissions=partner_permissions,
       provisioned_resources_parent=provisioned_resources_parent,
       resource_settings=resource_settings,
-      timeouts=timeouts
+      timeouts=timeouts,
+      violation_notifications_enabled=violation_notifications_enabled
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.assured_workloads_workload.newAttrs` constructs a new object with attributes and blocks configured for the `assured_workloads_workload`\nTerraform resource.\n\nUnlike [google.assured_workloads_workload.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `assured_workloads_workload` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.assured_workloads_workload.newAttrs` constructs a new object with attributes and blocks configured for the `assured_workloads_workload`\nTerraform resource.\n\nUnlike [google.assured_workloads_workload.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): Optional. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, `billingAccounts/012345-567890-ABCDEF`. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, HITRUST, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS, ISR_REGIONS, ISR_REGIONS_AND_SUPPORT, CA_PROTECTED_B, IL5, IL2, JP_REGIONS_AND_SUPPORT\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `enable_sovereign_controls` (`bool`): Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers. When `null`, the `enable_sovereign_controls` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels applied to the workload.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `partner` (`string`): Optional. Partner regime associated with this workload. Possible values: PARTNER_UNSPECIFIED, LOCAL_CONTROLS_BY_S3NS, SOVEREIGN_CONTROLS_BY_T_SYSTEMS, SOVEREIGN_CONTROLS_BY_SIA_MINSAIT, SOVEREIGN_CONTROLS_BY_PSN When `null`, the `partner` field will be omitted from the resulting object.\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `violation_notifications_enabled` (`bool`): Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload. When `null`, the `violation_notifications_enabled` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): **DEPRECATED** Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `partner_permissions` (`list[obj]`): Optional. Permissions granted to the AW Partner SA account for the customer workload When `null`, the `partner_permissions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.partner_permissions.new](#fn-partner_permissionsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `assured_workloads_workload` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
-    billing_account,
     compliance_regime,
     display_name,
     location,
     organization,
+    billing_account=null,
+    enable_sovereign_controls=null,
     kms_settings=null,
     labels=null,
+    partner=null,
+    partner_permissions=null,
     provisioned_resources_parent=null,
     resource_settings=null,
-    timeouts=null
+    timeouts=null,
+    violation_notifications_enabled=null
   ):: std.prune(a={
     billing_account: billing_account,
     compliance_regime: compliance_regime,
     display_name: display_name,
+    enable_sovereign_controls: enable_sovereign_controls,
     kms_settings: kms_settings,
     labels: labels,
     location: location,
     organization: organization,
+    partner: partner,
+    partner_permissions: partner_permissions,
     provisioned_resources_parent: provisioned_resources_parent,
     resource_settings: resource_settings,
     timeouts: timeouts,
+    violation_notifications_enabled: violation_notifications_enabled,
   }),
+  partner_permissions:: {
+    '#new':: d.fn(help='\n`google.assured_workloads_workload.partner_permissions.new` constructs a new object with attributes and blocks configured for the `partner_permissions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `assured_workloads_monitoring` (`bool`): Optional. Allow partner to view violation alerts. When `null`, the `assured_workloads_monitoring` field will be omitted from the resulting object.\n  - `data_logs_viewer` (`bool`): Allow the partner to view inspectability logs and monitoring violations. When `null`, the `data_logs_viewer` field will be omitted from the resulting object.\n  - `service_access_approver` (`bool`): Optional. Allow partner to view access approval logs. When `null`, the `service_access_approver` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `partner_permissions` sub block.\n', args=[]),
+    new(
+      assured_workloads_monitoring=null,
+      data_logs_viewer=null,
+      service_access_approver=null
+    ):: std.prune(a={
+      assured_workloads_monitoring: assured_workloads_monitoring,
+      data_logs_viewer: data_logs_viewer,
+      service_access_approver: service_access_approver,
+    }),
+  },
   resource_settings:: {
-    '#new':: d.fn(help='\n`google.assured_workloads_workload.resource_settings.new` constructs a new object with attributes and blocks configured for the `resource_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resource_id` (`string`): Resource identifier. For a project this represents project_number. If the project is already taken, the workload creation will fail. When `null`, the `resource_id` field will be omitted from the resulting object.\n  - `resource_type` (`string`): Indicates the type of resource. This field should be specified to correspond the id to the right project type (CONSUMER_PROJECT or ENCRYPTION_KEYS_PROJECT) Possible values: RESOURCE_TYPE_UNSPECIFIED, CONSUMER_PROJECT, ENCRYPTION_KEYS_PROJECT, KEYRING, CONSUMER_FOLDER When `null`, the `resource_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resource_settings` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.assured_workloads_workload.resource_settings.new` constructs a new object with attributes and blocks configured for the `resource_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `display_name` (`string`): User-assigned resource display name. If not empty it will be used to create a resource with the specified name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `resource_id` (`string`): Resource identifier. For a project this represents projectId. If the project is already taken, the workload creation will fail. For KeyRing, this represents the keyring_id. For a folder, don't set this value as folder_id is assigned by Google. When `null`, the `resource_id` field will be omitted from the resulting object.\n  - `resource_type` (`string`): Indicates the type of resource. This field should be specified to correspond the id to the right project type (CONSUMER_PROJECT or ENCRYPTION_KEYS_PROJECT) Possible values: RESOURCE_TYPE_UNSPECIFIED, CONSUMER_PROJECT, ENCRYPTION_KEYS_PROJECT, KEYRING, CONSUMER_FOLDER When `null`, the `resource_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resource_settings` sub block.\n', args=[]),
     new(
+      display_name=null,
       resource_id=null,
       resource_type=null
     ):: std.prune(a={
+      display_name: display_name,
       resource_id: resource_id,
       resource_type: resource_type,
     }),
@@ -119,6 +149,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEnableSovereignControls':: d.fn(help='`google.bool.withEnableSovereignControls` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_sovereign_controls field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_sovereign_controls` field.\n', args=[]),
+  withEnableSovereignControls(resourceLabel, value): {
+    resource+: {
+      google_assured_workloads_workload+: {
+        [resourceLabel]+: {
+          enable_sovereign_controls: value,
+        },
+      },
+    },
+  },
   '#withKmsSettings':: d.fn(help='`google.list[obj].withKmsSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the kms_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withKmsSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `kms_settings` field.\n', args=[]),
   withKmsSettings(resourceLabel, value): {
     resource+: {
@@ -169,6 +209,36 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPartner':: d.fn(help='`google.string.withPartner` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the partner field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `partner` field.\n', args=[]),
+  withPartner(resourceLabel, value): {
+    resource+: {
+      google_assured_workloads_workload+: {
+        [resourceLabel]+: {
+          partner: value,
+        },
+      },
+    },
+  },
+  '#withPartnerPermissions':: d.fn(help='`google.list[obj].withPartnerPermissions` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the partner_permissions field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPartnerPermissionsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `partner_permissions` field.\n', args=[]),
+  withPartnerPermissions(resourceLabel, value): {
+    resource+: {
+      google_assured_workloads_workload+: {
+        [resourceLabel]+: {
+          partner_permissions: value,
+        },
+      },
+    },
+  },
+  '#withPartnerPermissionsMixin':: d.fn(help='`google.list[obj].withPartnerPermissionsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the partner_permissions field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPartnerPermissions](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `partner_permissions` field.\n', args=[]),
+  withPartnerPermissionsMixin(resourceLabel, value): {
+    resource+: {
+      google_assured_workloads_workload+: {
+        [resourceLabel]+: {
+          partner_permissions+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withProvisionedResourcesParent':: d.fn(help='`google.string.withProvisionedResourcesParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the provisioned_resources_parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `provisioned_resources_parent` field.\n', args=[]),
   withProvisionedResourcesParent(resourceLabel, value): {
     resource+: {
@@ -219,4 +289,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withViolationNotificationsEnabled':: d.fn(help='`google.bool.withViolationNotificationsEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the violation_notifications_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `violation_notifications_enabled` field.\n', args=[]),
+  withViolationNotificationsEnabled(resourceLabel, value): {
+    resource+: {
+      google_assured_workloads_workload+: {
+        [resourceLabel]+: {
+          violation_notifications_enabled: value,
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/beyondcorp_app_connection.libsonnet b/4.x/_gen/resources/beyondcorp_app_connection.libsonnet
index 16589ca3..b01f8fe2 100644
--- a/4.x/_gen/resources/beyondcorp_app_connection.libsonnet
+++ b/4.x/_gen/resources/beyondcorp_app_connection.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.beyondcorp_app_connection.new` injects a new `google_beyondcorp_app_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connection` using the reference:\n\n    $._ref.google_beyondcorp_app_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.beyondcorp_app_connection.new` injects a new `google_beyondcorp_app_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connection` using the reference:\n\n    $._ref.google_beyondcorp_app_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -53,7 +53,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connection.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connection`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connection.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connection`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     application_endpoint=null,
diff --git a/4.x/_gen/resources/beyondcorp_app_connector.libsonnet b/4.x/_gen/resources/beyondcorp_app_connector.libsonnet
index 138f4820..2b3e8481 100644
--- a/4.x/_gen/resources/beyondcorp_app_connector.libsonnet
+++ b/4.x/_gen/resources/beyondcorp_app_connector.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='beyondcorp_app_connector', url='', help='`beyondcorp_app_connector` represents the `google_beyondcorp_app_connector` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.beyondcorp_app_connector.new` injects a new `google_beyondcorp_app_connector` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connector.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connector` using the reference:\n\n    $._ref.google_beyondcorp_app_connector.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connector.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.beyondcorp_app_connector.new` injects a new `google_beyondcorp_app_connector` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connector.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connector` using the reference:\n\n    $._ref.google_beyondcorp_app_connector.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connector.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connector.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connector`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connector.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connector` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connector.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connector`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connector.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connector` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     display_name=null,
diff --git a/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet b/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet
index 50477a70..42de7060 100644
--- a/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet
+++ b/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='beyondcorp_app_gateway', url='', help='`beyondcorp_app_gateway` represents the `google_beyondcorp_app_gateway` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.beyondcorp_app_gateway.new` injects a new `google_beyondcorp_app_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_gateway` using the reference:\n\n    $._ref.google_beyondcorp_app_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: \u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;GCP_REGIONAL_MIG\u0026#34;] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;TCP_PROXY\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.beyondcorp_app_gateway.new` injects a new `google_beyondcorp_app_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_gateway` using the reference:\n\n    $._ref.google_beyondcorp_app_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: \u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;GCP_REGIONAL_MIG\u0026#34;] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;TCP_PROXY\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_gateway`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "TCP_PROXY"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_gateway` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_gateway`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "TCP_PROXY"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_gateway` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     display_name=null,
@@ -50,13 +50,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type: type,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.beyondcorp_app_gateway.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.beyondcorp_app_gateway.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
diff --git a/4.x/_gen/resources/bigquery_analytics_hub_listing.libsonnet b/4.x/_gen/resources/bigquery_analytics_hub_listing.libsonnet
index e5daacdb..5795c209 100644
--- a/4.x/_gen/resources/bigquery_analytics_hub_listing.libsonnet
+++ b/4.x/_gen/resources/bigquery_analytics_hub_listing.libsonnet
@@ -20,7 +20,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       primary_contact: primary_contact,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_analytics_hub_listing.new` injects a new `google_bigquery_analytics_hub_listing` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_analytics_hub_listing.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_analytics_hub_listing` using the reference:\n\n    $._ref.google_bigquery_analytics_hub_listing.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_analytics_hub_listing.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `categories` (`list`): Categories of the listing. Up to two categories are allowed. When `null`, the `categories` field will be omitted from the resulting object.\n  - `data_exchange_id` (`string`): The ID of the data exchange. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `description` (`string`): Short description of the listing. The description must not contain Unicode non-characters and C0 and C1 control codes except tabs (HT), new lines (LF), carriage returns (CR), and page breaks (FF). When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Human-readable display name of the listing. The display name must contain only Unicode letters, numbers (0-9), underscores (_), dashes (-), spaces ( ), ampersands (\u0026amp;) and can\u0026#39;t start or end with spaces.\n  - `documentation` (`string`): Documentation describing the listing. When `null`, the `documentation` field will be omitted from the resulting object.\n  - `icon` (`string`): Base64 encoded image representing the listing. When `null`, the `icon` field will be omitted from the resulting object.\n  - `listing_id` (`string`): The ID of the listing. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `location` (`string`): The name of the location this data exchange listing.\n  - `primary_contact` (`string`): Email or URL of the primary point of contact of the listing. When `null`, the `primary_contact` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `request_access` (`string`): Email or URL of the request access of the listing. Subscribers can use this reference to request access. When `null`, the `request_access` field will be omitted from the resulting object.\n  - `bigquery_dataset` (`list[obj]`): Shared dataset i.e. BigQuery dataset source. When `null`, the `bigquery_dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.bigquery_dataset.new](#fn-bigquery_datasetnew) constructor.\n  - `data_provider` (`list[obj]`): Details of the data provider who owns the source data. When `null`, the `data_provider` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.data_provider.new](#fn-data_providernew) constructor.\n  - `publisher` (`list[obj]`): Details of the publisher who owns the listing and who can share the source data. When `null`, the `publisher` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.publisher.new](#fn-publishernew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_analytics_hub_listing.new` injects a new `google_bigquery_analytics_hub_listing` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_analytics_hub_listing.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_analytics_hub_listing` using the reference:\n\n    $._ref.google_bigquery_analytics_hub_listing.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_analytics_hub_listing.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `categories` (`list`): Categories of the listing. Up to two categories are allowed. When `null`, the `categories` field will be omitted from the resulting object.\n  - `data_exchange_id` (`string`): The ID of the data exchange. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `description` (`string`): Short description of the listing. The description must not contain Unicode non-characters and C0 and C1 control codes except tabs (HT), new lines (LF), carriage returns (CR), and page breaks (FF). When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Human-readable display name of the listing. The display name must contain only Unicode letters, numbers (0-9), underscores (_), dashes (-), spaces ( ), ampersands (\u0026amp;) and can\u0026#39;t start or end with spaces.\n  - `documentation` (`string`): Documentation describing the listing. When `null`, the `documentation` field will be omitted from the resulting object.\n  - `icon` (`string`): Base64 encoded image representing the listing. When `null`, the `icon` field will be omitted from the resulting object.\n  - `listing_id` (`string`): The ID of the listing. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `location` (`string`): The name of the location this data exchange listing.\n  - `primary_contact` (`string`): Email or URL of the primary point of contact of the listing. When `null`, the `primary_contact` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `request_access` (`string`): Email or URL of the request access of the listing. Subscribers can use this reference to request access. When `null`, the `request_access` field will be omitted from the resulting object.\n  - `bigquery_dataset` (`list[obj]`): Shared dataset i.e. BigQuery dataset source. When `null`, the `bigquery_dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.bigquery_dataset.new](#fn-bigquery_datasetnew) constructor.\n  - `data_provider` (`list[obj]`): Details of the data provider who owns the source data. When `null`, the `data_provider` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.data_provider.new](#fn-data_providernew) constructor.\n  - `publisher` (`list[obj]`): Details of the publisher who owns the listing and who can share the source data. When `null`, the `publisher` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.publisher.new](#fn-publishernew) constructor.\n  - `restricted_export_config` (`list[obj]`): If set, restricted export configuration will be propagated and enforced on the linked dataset. When `null`, the `restricted_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.restricted_export_config.new](#fn-restricted_export_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     data_exchange_id,
@@ -37,6 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     publisher=null,
     request_access=null,
+    restricted_export_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -57,11 +58,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       publisher=publisher,
       request_access=request_access,
+      restricted_export_config=restricted_export_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_analytics_hub_listing.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_analytics_hub_listing`\nTerraform resource.\n\nUnlike [google.bigquery_analytics_hub_listing.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `categories` (`list`): Categories of the listing. Up to two categories are allowed. When `null`, the `categories` field will be omitted from the resulting object.\n  - `data_exchange_id` (`string`): The ID of the data exchange. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `description` (`string`): Short description of the listing. The description must not contain Unicode non-characters and C0 and C1 control codes except tabs (HT), new lines (LF), carriage returns (CR), and page breaks (FF). When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Human-readable display name of the listing. The display name must contain only Unicode letters, numbers (0-9), underscores (_), dashes (-), spaces ( ), ampersands (&) and can't start or end with spaces.\n  - `documentation` (`string`): Documentation describing the listing. When `null`, the `documentation` field will be omitted from the resulting object.\n  - `icon` (`string`): Base64 encoded image representing the listing. When `null`, the `icon` field will be omitted from the resulting object.\n  - `listing_id` (`string`): The ID of the listing. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `location` (`string`): The name of the location this data exchange listing.\n  - `primary_contact` (`string`): Email or URL of the primary point of contact of the listing. When `null`, the `primary_contact` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `request_access` (`string`): Email or URL of the request access of the listing. Subscribers can use this reference to request access. When `null`, the `request_access` field will be omitted from the resulting object.\n  - `bigquery_dataset` (`list[obj]`): Shared dataset i.e. BigQuery dataset source. When `null`, the `bigquery_dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.bigquery_dataset.new](#fn-bigquery_datasetnew) constructor.\n  - `data_provider` (`list[obj]`): Details of the data provider who owns the source data. When `null`, the `data_provider` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.data_provider.new](#fn-data_providernew) constructor.\n  - `publisher` (`list[obj]`): Details of the publisher who owns the listing and who can share the source data. When `null`, the `publisher` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.publisher.new](#fn-publishernew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_analytics_hub_listing` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_analytics_hub_listing.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_analytics_hub_listing`\nTerraform resource.\n\nUnlike [google.bigquery_analytics_hub_listing.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `categories` (`list`): Categories of the listing. Up to two categories are allowed. When `null`, the `categories` field will be omitted from the resulting object.\n  - `data_exchange_id` (`string`): The ID of the data exchange. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `description` (`string`): Short description of the listing. The description must not contain Unicode non-characters and C0 and C1 control codes except tabs (HT), new lines (LF), carriage returns (CR), and page breaks (FF). When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Human-readable display name of the listing. The display name must contain only Unicode letters, numbers (0-9), underscores (_), dashes (-), spaces ( ), ampersands (&) and can't start or end with spaces.\n  - `documentation` (`string`): Documentation describing the listing. When `null`, the `documentation` field will be omitted from the resulting object.\n  - `icon` (`string`): Base64 encoded image representing the listing. When `null`, the `icon` field will be omitted from the resulting object.\n  - `listing_id` (`string`): The ID of the listing. Must contain only Unicode letters, numbers (0-9), underscores (_). Should not use characters that require URL-escaping, or characters outside of ASCII, spaces.\n  - `location` (`string`): The name of the location this data exchange listing.\n  - `primary_contact` (`string`): Email or URL of the primary point of contact of the listing. When `null`, the `primary_contact` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `request_access` (`string`): Email or URL of the request access of the listing. Subscribers can use this reference to request access. When `null`, the `request_access` field will be omitted from the resulting object.\n  - `bigquery_dataset` (`list[obj]`): Shared dataset i.e. BigQuery dataset source. When `null`, the `bigquery_dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.bigquery_dataset.new](#fn-bigquery_datasetnew) constructor.\n  - `data_provider` (`list[obj]`): Details of the data provider who owns the source data. When `null`, the `data_provider` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.data_provider.new](#fn-data_providernew) constructor.\n  - `publisher` (`list[obj]`): Details of the publisher who owns the listing and who can share the source data. When `null`, the `publisher` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.publisher.new](#fn-publishernew) constructor.\n  - `restricted_export_config` (`list[obj]`): If set, restricted export configuration will be propagated and enforced on the linked dataset. When `null`, the `restricted_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.restricted_export_config.new](#fn-restricted_export_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_analytics_hub_listing` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     data_exchange_id,
     display_name,
@@ -77,6 +79,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     publisher=null,
     request_access=null,
+    restricted_export_config=null,
     timeouts=null
   ):: std.prune(a={
     bigquery_dataset: bigquery_dataset,
@@ -93,6 +96,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     publisher: publisher,
     request_access: request_access,
+    restricted_export_config: restricted_export_config,
     timeouts: timeouts,
   }),
   publisher:: {
@@ -105,6 +109,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       primary_contact: primary_contact,
     }),
   },
+  restricted_export_config:: {
+    '#new':: d.fn(help='\n`google.bigquery_analytics_hub_listing.restricted_export_config.new` constructs a new object with attributes and blocks configured for the `restricted_export_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, enable restricted export. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `restrict_query_result` (`bool`): If true, restrict export of query result derived from restricted linked dataset table. When `null`, the `restrict_query_result` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `restricted_export_config` sub block.\n', args=[]),
+    new(
+      enabled=null,
+      restrict_query_result=null
+    ):: std.prune(a={
+      enabled: enabled,
+      restrict_query_result: restrict_query_result,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.bigquery_analytics_hub_listing.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -287,6 +301,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRestrictedExportConfig':: d.fn(help='`google.list[obj].withRestrictedExportConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the restricted_export_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withRestrictedExportConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `restricted_export_config` field.\n', args=[]),
+  withRestrictedExportConfig(resourceLabel, value): {
+    resource+: {
+      google_bigquery_analytics_hub_listing+: {
+        [resourceLabel]+: {
+          restricted_export_config: value,
+        },
+      },
+    },
+  },
+  '#withRestrictedExportConfigMixin':: d.fn(help='`google.list[obj].withRestrictedExportConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the restricted_export_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withRestrictedExportConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `restricted_export_config` field.\n', args=[]),
+  withRestrictedExportConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_bigquery_analytics_hub_listing+: {
+        [resourceLabel]+: {
+          restricted_export_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet b/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet
index c2f8f85f..66345d45 100644
--- a/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet
+++ b/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='bigquery_capacity_commitment', url='', help='`bigquery_capacity_commitment` represents the `google_bigquery_capacity_commitment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.bigquery_capacity_commitment.new` injects a new `google_bigquery_capacity_commitment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_capacity_commitment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_capacity_commitment` using the reference:\n\n    $._ref.google_bigquery_capacity_commitment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_capacity_commitment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won\u0026#39;t be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_capacity_commitment.new` injects a new `google_bigquery_capacity_commitment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_capacity_commitment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_capacity_commitment` using the reference:\n\n    $._ref.google_bigquery_capacity_commitment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_capacity_commitment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won\u0026#39;t be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     plan,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_capacity_commitment.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_capacity_commitment`\nTerraform resource.\n\nUnlike [google.bigquery_capacity_commitment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won't be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_capacity_commitment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_capacity_commitment.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_capacity_commitment`\nTerraform resource.\n\nUnlike [google.bigquery_capacity_commitment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won't be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_capacity_commitment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     plan,
     slot_count,
diff --git a/4.x/_gen/resources/bigquery_connection.libsonnet b/4.x/_gen/resources/bigquery_connection.libsonnet
index ef95b6f2..18eff52f 100644
--- a/4.x/_gen/resources/bigquery_connection.libsonnet
+++ b/4.x/_gen/resources/bigquery_connection.libsonnet
@@ -35,13 +35,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ):: std.prune(a={}),
   },
   cloud_spanner:: {
-    '#new':: d.fn(help='\n`google.bigquery_connection.cloud_spanner.new` constructs a new object with attributes and blocks configured for the `cloud_spanner`\nTerraform sub block.\n\n\n\n**Args**:\n  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'\n  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner When `null`, the `use_parallelism` field will be omitted from the resulting object.\n  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. useParallelism must be set when using serverless analytics When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cloud_spanner` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.bigquery_connection.cloud_spanner.new` constructs a new object with attributes and blocks configured for the `cloud_spanner`\nTerraform sub block.\n\n\n\n**Args**:\n  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'.\n  - `database_role` (`string`): Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin should have provisioned the database role with appropriate permissions, such as 'SELECT' and 'INSERT'. Other users should only use roles provided by their Cloud Spanner admins. The database role name must start with a letter, and can only contain letters, numbers, and underscores. For more details, see https://cloud.google.com/spanner/docs/fgac-about. When `null`, the `database_role` field will be omitted from the resulting object.\n  - `max_parallelism` (`number`): Allows setting max parallelism per query when executing on Spanner independent compute resources. If unspecified, default values of parallelism are chosen that are dependent on the Cloud Spanner instance configuration. 'useParallelism' and 'useDataBoost' must be set when setting max parallelism. When `null`, the `max_parallelism` field will be omitted from the resulting object.\n  - `use_data_boost` (`bool`): If set, the request will be executed via Spanner independent compute resources. 'use_parallelism' must be set when using data boost. When `null`, the `use_data_boost` field will be omitted from the resulting object.\n  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner. When `null`, the `use_parallelism` field will be omitted from the resulting object.\n  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. 'useParallelism' must be set when using serverless analytics. When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cloud_spanner` sub block.\n', args=[]),
     new(
       database,
+      database_role=null,
+      max_parallelism=null,
+      use_data_boost=null,
       use_parallelism=null,
       use_serverless_analytics=null
     ):: std.prune(a={
       database: database,
+      database_role: database_role,
+      max_parallelism: max_parallelism,
+      use_data_boost: use_data_boost,
       use_parallelism: use_parallelism,
       use_serverless_analytics: use_serverless_analytics,
     }),
@@ -70,7 +76,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_connection.new` injects a new `google_bigquery_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_connection` using the reference:\n\n    $._ref.google_bigquery_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_id` (`string`): Optional connection id that should be assigned to the created connection. When `null`, the `connection_id` field will be omitted from the resulting object.\n  - `description` (`string`): A descriptive description for the connection When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the connection When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the connection should reside.\nCloud SQL instance must be in the same location as the connection\nwith following exceptions: Cloud SQL us-central1 maps to BigQuery US, Cloud SQL europe-west1 maps to BigQuery EU.\nExamples: US, EU, asia-northeast1, us-central1, europe-west1.\nSpanner Connections same as spanner region\nAWS allowed regions are aws-us-east-1\nAzure allowed regions are azure-eastus2 When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `aws` (`list[obj]`): Connection properties specific to Amazon Web Services. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.aws.new](#fn-awsnew) constructor.\n  - `azure` (`list[obj]`): Container for connection properties specific to Azure. When `null`, the `azure` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.azure.new](#fn-azurenew) constructor.\n  - `cloud_resource` (`list[obj]`): Container for connection properties for delegation of access to GCP resources. When `null`, the `cloud_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_resource.new](#fn-cloud_resourcenew) constructor.\n  - `cloud_spanner` (`list[obj]`): Connection properties specific to Cloud Spanner When `null`, the `cloud_spanner` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_spanner.new](#fn-cloud_spannernew) constructor.\n  - `cloud_sql` (`list[obj]`): Connection properties specific to the Cloud SQL. When `null`, the `cloud_sql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_sql.new](#fn-cloud_sqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_connection.new` injects a new `google_bigquery_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_connection` using the reference:\n\n    $._ref.google_bigquery_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_id` (`string`): Optional connection id that should be assigned to the created connection. When `null`, the `connection_id` field will be omitted from the resulting object.\n  - `description` (`string`): A descriptive description for the connection When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the connection When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the connection should reside.\nCloud SQL instance must be in the same location as the connection\nwith following exceptions: Cloud SQL us-central1 maps to BigQuery US, Cloud SQL europe-west1 maps to BigQuery EU.\nExamples: US, EU, asia-northeast1, us-central1, europe-west1.\nSpanner Connections same as spanner region\nAWS allowed regions are aws-us-east-1\nAzure allowed regions are azure-eastus2 When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `aws` (`list[obj]`): Connection properties specific to Amazon Web Services. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.aws.new](#fn-awsnew) constructor.\n  - `azure` (`list[obj]`): Container for connection properties specific to Azure. When `null`, the `azure` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.azure.new](#fn-azurenew) constructor.\n  - `cloud_resource` (`list[obj]`): Container for connection properties for delegation of access to GCP resources. When `null`, the `cloud_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_resource.new](#fn-cloud_resourcenew) constructor.\n  - `cloud_spanner` (`list[obj]`): Connection properties specific to Cloud Spanner When `null`, the `cloud_spanner` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_spanner.new](#fn-cloud_spannernew) constructor.\n  - `cloud_sql` (`list[obj]`): Connection properties specific to the Cloud SQL. When `null`, the `cloud_sql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_sql.new](#fn-cloud_sqlnew) constructor.\n  - `spark` (`list[obj]`): Container for connection properties to execute stored procedures for Apache Spark. resources. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     aws=null,
@@ -83,6 +89,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     friendly_name=null,
     location=null,
     project=null,
+    spark=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -99,11 +106,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       friendly_name=friendly_name,
       location=location,
       project=project,
+      spark=spark,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_connection.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_connection`\nTerraform resource.\n\nUnlike [google.bigquery_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_id` (`string`): Optional connection id that should be assigned to the created connection. When `null`, the `connection_id` field will be omitted from the resulting object.\n  - `description` (`string`): A descriptive description for the connection When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the connection When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the connection should reside.\nCloud SQL instance must be in the same location as the connection\nwith following exceptions: Cloud SQL us-central1 maps to BigQuery US, Cloud SQL europe-west1 maps to BigQuery EU.\nExamples: US, EU, asia-northeast1, us-central1, europe-west1.\nSpanner Connections same as spanner region\nAWS allowed regions are aws-us-east-1\nAzure allowed regions are azure-eastus2 When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `aws` (`list[obj]`): Connection properties specific to Amazon Web Services. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.aws.new](#fn-awsnew) constructor.\n  - `azure` (`list[obj]`): Container for connection properties specific to Azure. When `null`, the `azure` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.azure.new](#fn-azurenew) constructor.\n  - `cloud_resource` (`list[obj]`): Container for connection properties for delegation of access to GCP resources. When `null`, the `cloud_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_resource.new](#fn-cloud_resourcenew) constructor.\n  - `cloud_spanner` (`list[obj]`): Connection properties specific to Cloud Spanner When `null`, the `cloud_spanner` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_spanner.new](#fn-cloud_spannernew) constructor.\n  - `cloud_sql` (`list[obj]`): Connection properties specific to the Cloud SQL. When `null`, the `cloud_sql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_sql.new](#fn-cloud_sqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_connection.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_connection`\nTerraform resource.\n\nUnlike [google.bigquery_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_id` (`string`): Optional connection id that should be assigned to the created connection. When `null`, the `connection_id` field will be omitted from the resulting object.\n  - `description` (`string`): A descriptive description for the connection When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the connection When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the connection should reside.\nCloud SQL instance must be in the same location as the connection\nwith following exceptions: Cloud SQL us-central1 maps to BigQuery US, Cloud SQL europe-west1 maps to BigQuery EU.\nExamples: US, EU, asia-northeast1, us-central1, europe-west1.\nSpanner Connections same as spanner region\nAWS allowed regions are aws-us-east-1\nAzure allowed regions are azure-eastus2 When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `aws` (`list[obj]`): Connection properties specific to Amazon Web Services. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.aws.new](#fn-awsnew) constructor.\n  - `azure` (`list[obj]`): Container for connection properties specific to Azure. When `null`, the `azure` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.azure.new](#fn-azurenew) constructor.\n  - `cloud_resource` (`list[obj]`): Container for connection properties for delegation of access to GCP resources. When `null`, the `cloud_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_resource.new](#fn-cloud_resourcenew) constructor.\n  - `cloud_spanner` (`list[obj]`): Connection properties specific to Cloud Spanner When `null`, the `cloud_spanner` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_spanner.new](#fn-cloud_spannernew) constructor.\n  - `cloud_sql` (`list[obj]`): Connection properties specific to the Cloud SQL. When `null`, the `cloud_sql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_sql.new](#fn-cloud_sqlnew) constructor.\n  - `spark` (`list[obj]`): Container for connection properties to execute stored procedures for Apache Spark. resources. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     aws=null,
     azure=null,
@@ -115,6 +123,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     friendly_name=null,
     location=null,
     project=null,
+    spark=null,
     timeouts=null
   ):: std.prune(a={
     aws: aws,
@@ -127,8 +136,35 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     friendly_name: friendly_name,
     location: location,
     project: project,
+    spark: spark,
     timeouts: timeouts,
   }),
+  spark:: {
+    metastore_service_config:: {
+      '#new':: d.fn(help='\n`google.bigquery_connection.spark.metastore_service_config.new` constructs a new object with attributes and blocks configured for the `metastore_service_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metastore_service` (`string`): Resource name of an existing Dataproc Metastore service in the form of projects/[projectId]/locations/[region]/services/[serviceId]. When `null`, the `metastore_service` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `metastore_service_config` sub block.\n', args=[]),
+      new(
+        metastore_service=null
+      ):: std.prune(a={
+        metastore_service: metastore_service,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.bigquery_connection.spark.new` constructs a new object with attributes and blocks configured for the `spark`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metastore_service_config` (`list[obj]`): Dataproc Metastore Service configuration for the connection. When `null`, the `metastore_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.metastore_service_config.new](#fn-sparkmetastore_service_confignew) constructor.\n  - `spark_history_server_config` (`list[obj]`): Spark History Server configuration for the connection. When `null`, the `spark_history_server_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.spark_history_server_config.new](#fn-sparkspark_history_server_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `spark` sub block.\n', args=[]),
+    new(
+      metastore_service_config=null,
+      spark_history_server_config=null
+    ):: std.prune(a={
+      metastore_service_config: metastore_service_config,
+      spark_history_server_config: spark_history_server_config,
+    }),
+    spark_history_server_config:: {
+      '#new':: d.fn(help='\n`google.bigquery_connection.spark.spark_history_server_config.new` constructs a new object with attributes and blocks configured for the `spark_history_server_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dataproc_cluster` (`string`): Resource name of an existing Dataproc Cluster to act as a Spark History Server for the connection if the form of projects/[projectId]/regions/[region]/clusters/[cluster_name]. When `null`, the `dataproc_cluster` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `spark_history_server_config` sub block.\n', args=[]),
+      new(
+        dataproc_cluster=null
+      ):: std.prune(a={
+        dataproc_cluster: dataproc_cluster,
+      }),
+    },
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.bigquery_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -291,6 +327,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSpark':: d.fn(help='`google.list[obj].withSpark` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the spark field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSparkMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `spark` field.\n', args=[]),
+  withSpark(resourceLabel, value): {
+    resource+: {
+      google_bigquery_connection+: {
+        [resourceLabel]+: {
+          spark: value,
+        },
+      },
+    },
+  },
+  '#withSparkMixin':: d.fn(help='`google.list[obj].withSparkMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the spark field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSpark](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `spark` field.\n', args=[]),
+  withSparkMixin(resourceLabel, value): {
+    resource+: {
+      google_bigquery_connection+: {
+        [resourceLabel]+: {
+          spark+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/bigquery_dataset.libsonnet b/4.x/_gen/resources/bigquery_dataset.libsonnet
index df57fea8..1f40ddce 100644
--- a/4.x/_gen/resources/bigquery_dataset.libsonnet
+++ b/4.x/_gen/resources/bigquery_dataset.libsonnet
@@ -23,11 +23,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         target_types: target_types,
       }),
     },
-    '#new':: d.fn(help='\n`google.bigquery_dataset.access.new` constructs a new object with attributes and blocks configured for the `access`\nTerraform sub block.\n\n\n\n**Args**:\n  - `domain` (`string`): A domain to grant access to. Any users signed in with the\ndomain specified will be granted the specified access When `null`, the `domain` field will be omitted from the resulting object.\n  - `group_by_email` (`string`): An email address of a Google Group to grant access to. When `null`, the `group_by_email` field will be omitted from the resulting object.\n  - `role` (`string`): Describes the rights granted to the user specified by the other\nmember of the access object. Basic, predefined, and custom roles\nare supported. Predefined roles that have equivalent basic roles\nare swapped by the API to their basic counterparts. See\n[official docs](https://cloud.google.com/bigquery/docs/access-control). When `null`, the `role` field will be omitted from the resulting object.\n  - `special_group` (`string`): A special group to grant access to. Possible values include:\n\n\n* 'projectOwners': Owners of the enclosing project.\n\n\n* 'projectReaders': Readers of the enclosing project.\n\n\n* 'projectWriters': Writers of the enclosing project.\n\n\n* 'allAuthenticatedUsers': All authenticated BigQuery users. When `null`, the `special_group` field will be omitted from the resulting object.\n  - `user_by_email` (`string`): An email address of a user to grant access to. For example:\nfred@example.com When `null`, the `user_by_email` field will be omitted from the resulting object.\n  - `dataset` (`list[obj]`): Grants all resources of particular types in a particular dataset read access to the current dataset. When `null`, the `dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.dataset.new](#fn-accessdatasetnew) constructor.\n  - `routine` (`list[obj]`): A routine from a different dataset to grant access to. Queries\nexecuted against that routine will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that routine is updated by any user, access to the routine\nneeds to be granted again via an update operation. When `null`, the `routine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.routine.new](#fn-accessroutinenew) constructor.\n  - `view` (`list[obj]`): A view from a different dataset to grant access to. Queries\nexecuted against that view will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that view is updated by any user, access to the view\nneeds to be granted again via an update operation. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.view.new](#fn-accessviewnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `access` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.bigquery_dataset.access.new` constructs a new object with attributes and blocks configured for the `access`\nTerraform sub block.\n\n\n\n**Args**:\n  - `domain` (`string`): A domain to grant access to. Any users signed in with the\ndomain specified will be granted the specified access When `null`, the `domain` field will be omitted from the resulting object.\n  - `group_by_email` (`string`): An email address of a Google Group to grant access to. When `null`, the `group_by_email` field will be omitted from the resulting object.\n  - `iam_member` (`string`): Some other type of member that appears in the IAM Policy but isn't a user,\ngroup, domain, or special group. For example: 'allUsers' When `null`, the `iam_member` field will be omitted from the resulting object.\n  - `role` (`string`): Describes the rights granted to the user specified by the other\nmember of the access object. Basic, predefined, and custom roles\nare supported. Predefined roles that have equivalent basic roles\nare swapped by the API to their basic counterparts. See\n[official docs](https://cloud.google.com/bigquery/docs/access-control). When `null`, the `role` field will be omitted from the resulting object.\n  - `special_group` (`string`): A special group to grant access to. Possible values include:\n\n\n* 'projectOwners': Owners of the enclosing project.\n\n\n* 'projectReaders': Readers of the enclosing project.\n\n\n* 'projectWriters': Writers of the enclosing project.\n\n\n* 'allAuthenticatedUsers': All authenticated BigQuery users. When `null`, the `special_group` field will be omitted from the resulting object.\n  - `user_by_email` (`string`): An email address of a user to grant access to. For example:\nfred@example.com When `null`, the `user_by_email` field will be omitted from the resulting object.\n  - `dataset` (`list[obj]`): Grants all resources of particular types in a particular dataset read access to the current dataset. When `null`, the `dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.dataset.new](#fn-accessdatasetnew) constructor.\n  - `routine` (`list[obj]`): A routine from a different dataset to grant access to. Queries\nexecuted against that routine will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that routine is updated by any user, access to the routine\nneeds to be granted again via an update operation. When `null`, the `routine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.routine.new](#fn-accessroutinenew) constructor.\n  - `view` (`list[obj]`): A view from a different dataset to grant access to. Queries\nexecuted against that view will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that view is updated by any user, access to the view\nneeds to be granted again via an update operation. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.view.new](#fn-accessviewnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `access` sub block.\n', args=[]),
     new(
       dataset=null,
       domain=null,
       group_by_email=null,
+      iam_member=null,
       role=null,
       routine=null,
       special_group=null,
@@ -37,6 +38,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       dataset: dataset,
       domain: domain,
       group_by_email: group_by_email,
+      iam_member: iam_member,
       role: role,
       routine: routine,
       special_group: special_group,
@@ -76,7 +78,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_dataset.new` injects a new `google_bigquery_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_dataset` using the reference:\n\n    $._ref.google_bigquery_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- \u0026#39;und:ci\u0026#39;: undetermined locale, case insensitive.\n- \u0026#39;\u0026#39;: empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an \u0026#39;expirationMs\u0026#39; property in the \u0026#39;timePartitioning\u0026#39;\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of \u0026#39;defaultTableExpirationMs\u0026#39;\nfor partitioned tables: only one of \u0026#39;defaultTableExpirationMs\u0026#39; and\n\u0026#39;defaultPartitionExpirationMs\u0026#39; will be used for any new partitioned\ntable. If you provide an explicit \u0026#39;timePartitioning.expirationMs\u0026#39; when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an \u0026#39;expirationTime\u0026#39; property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the \u0026#39;expirationTime\u0026#39; for a given\ntable is reached, that table will be deleted automatically.\nIf a table\u0026#39;s \u0026#39;expirationTime\u0026#39; is modified or removed before the\ntable expires, or if you provide an explicit \u0026#39;expirationTime\u0026#39; when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to \u0026#39;true\u0026#39;, delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location \u0026#39;US\u0026#39;.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn\u0026#39;t specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_dataset.new` injects a new `google_bigquery_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_dataset` using the reference:\n\n    $._ref.google_bigquery_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- \u0026#39;und:ci\u0026#39;: undetermined locale, case insensitive.\n- \u0026#39;\u0026#39;: empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an \u0026#39;expirationMs\u0026#39; property in the \u0026#39;timePartitioning\u0026#39;\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of \u0026#39;defaultTableExpirationMs\u0026#39;\nfor partitioned tables: only one of \u0026#39;defaultTableExpirationMs\u0026#39; and\n\u0026#39;defaultPartitionExpirationMs\u0026#39; will be used for any new partitioned\ntable. If you provide an explicit \u0026#39;timePartitioning.expirationMs\u0026#39; when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an \u0026#39;expirationTime\u0026#39; property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the \u0026#39;expirationTime\u0026#39; for a given\ntable is reached, that table will be deleted automatically.\nIf a table\u0026#39;s \u0026#39;expirationTime\u0026#39; is modified or removed before the\ntable expires, or if you provide an explicit \u0026#39;expirationTime\u0026#39; when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to \u0026#39;true\u0026#39;, delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location \u0026#39;US\u0026#39;.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn\u0026#39;t specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset_id,
@@ -119,7 +121,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`\nTerraform resource.\n\nUnlike [google.bigquery_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- 'und:ci': undetermined locale, case insensitive.\n- '': empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an 'expirationMs' property in the 'timePartitioning'\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of 'defaultTableExpirationMs'\nfor partitioned tables: only one of 'defaultTableExpirationMs' and\n'defaultPartitionExpirationMs' will be used for any new partitioned\ntable. If you provide an explicit 'timePartitioning.expirationMs' when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an 'expirationTime' property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the 'expirationTime' for a given\ntable is reached, that table will be deleted automatically.\nIf a table's 'expirationTime' is modified or removed before the\ntable expires, or if you provide an explicit 'expirationTime' when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to 'true', delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location 'US'.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn't specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_dataset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`\nTerraform resource.\n\nUnlike [google.bigquery_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- 'und:ci': undetermined locale, case insensitive.\n- '': empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an 'expirationMs' property in the 'timePartitioning'\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of 'defaultTableExpirationMs'\nfor partitioned tables: only one of 'defaultTableExpirationMs' and\n'defaultPartitionExpirationMs' will be used for any new partitioned\ntable. If you provide an explicit 'timePartitioning.expirationMs' when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an 'expirationTime' property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the 'expirationTime' for a given\ntable is reached, that table will be deleted automatically.\nIf a table's 'expirationTime' is modified or removed before the\ntable expires, or if you provide an explicit 'expirationTime' when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to 'true', delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location 'US'.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn't specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_dataset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset_id,
     access=null,
diff --git a/4.x/_gen/resources/bigquery_job.libsonnet b/4.x/_gen/resources/bigquery_job.libsonnet
index 6ec174a7..88ad0675 100644
--- a/4.x/_gen/resources/bigquery_job.libsonnet
+++ b/4.x/_gen/resources/bigquery_job.libsonnet
@@ -186,7 +186,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.bigquery_job.new` injects a new `google_bigquery_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_job` using the reference:\n\n    $._ref.google_bigquery_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_job.new` injects a new `google_bigquery_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_job` using the reference:\n\n    $._ref.google_bigquery_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     job_id,
@@ -217,7 +217,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_job.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_job`\nTerraform resource.\n\nUnlike [google.bigquery_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_job.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_job`\nTerraform resource.\n\nUnlike [google.bigquery_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     job_id,
     copy=null,
@@ -334,13 +334,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     },
   },
   timeouts:: {
-    '#new':: d.fn(help='\n`google.bigquery_job.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.bigquery_job.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withCopy':: d.fn(help='`google.list[obj].withCopy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the copy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCopyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `copy` field.\n', args=[]),
diff --git a/4.x/_gen/resources/bigquery_routine.libsonnet b/4.x/_gen/resources/bigquery_routine.libsonnet
index c3a73c84..0a61dc55 100644
--- a/4.x/_gen/resources/bigquery_routine.libsonnet
+++ b/4.x/_gen/resources/bigquery_routine.libsonnet
@@ -16,12 +16,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name: name,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_routine.new` injects a new `google_bigquery_routine` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_routine.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_routine` using the reference:\n\n    $._ref.google_bigquery_routine.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_routine.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: [\u0026#34;DETERMINISM_LEVEL_UNSPECIFIED\u0026#34;, \u0026#34;DETERMINISTIC\u0026#34;, \u0026#34;NOT_DETERMINISTIC\u0026#34;] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = \u0026#34;JAVASCRIPT\u0026#34;, this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: [\u0026#34;SQL\u0026#34;, \u0026#34;JAVASCRIPT\u0026#34;] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;.\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = \u0026#34;SQL\u0026#34;; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~\u0026gt;**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn\u0026#39;t\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: [\u0026#34;SCALAR_FUNCTION\u0026#34;, \u0026#34;PROCEDURE\u0026#34;, \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;] When `null`, the `routine_type` field will be omitted from the resulting object.\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_routine.new` injects a new `google_bigquery_routine` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_routine.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_routine` using the reference:\n\n    $._ref.google_bigquery_routine.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_routine.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: [\u0026#34;DETERMINISM_LEVEL_UNSPECIFIED\u0026#34;, \u0026#34;DETERMINISTIC\u0026#34;, \u0026#34;NOT_DETERMINISTIC\u0026#34;] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = \u0026#34;JAVASCRIPT\u0026#34;, this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: [\u0026#34;SQL\u0026#34;, \u0026#34;JAVASCRIPT\u0026#34;, \u0026#34;PYTHON\u0026#34;, \u0026#34;JAVA\u0026#34;, \u0026#34;SCALA\u0026#34;] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;.\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = \u0026#34;SQL\u0026#34;; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~\u0026gt;**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn\u0026#39;t\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: [\u0026#34;SCALAR_FUNCTION\u0026#34;, \u0026#34;PROCEDURE\u0026#34;, \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;]\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `spark_options` (`list[obj]`): Optional. If language is one of \u0026#34;PYTHON\u0026#34;, \u0026#34;JAVA\u0026#34;, \u0026#34;SCALA\u0026#34;, this field stores the options for spark stored procedure. When `null`, the `spark_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.spark_options.new](#fn-spark_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset_id,
     definition_body,
     routine_id,
+    routine_type,
     arguments=null,
     description=null,
     determinism_level=null,
@@ -30,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     return_table_type=null,
     return_type=null,
-    routine_type=null,
+    spark_options=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -49,15 +50,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       return_type=return_type,
       routine_id=routine_id,
       routine_type=routine_type,
+      spark_options=spark_options,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_routine.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_routine`\nTerraform resource.\n\nUnlike [google.bigquery_routine.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: ["DETERMINISM_LEVEL_UNSPECIFIED", "DETERMINISTIC", "NOT_DETERMINISTIC"] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = "JAVASCRIPT", this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT"] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = "TABLE_VALUED_FUNCTION".\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = "SQL"; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~>**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn't\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"] When `null`, the `routine_type` field will be omitted from the resulting object.\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_routine` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_routine.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_routine`\nTerraform resource.\n\nUnlike [google.bigquery_routine.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: ["DETERMINISM_LEVEL_UNSPECIFIED", "DETERMINISTIC", "NOT_DETERMINISTIC"] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = "JAVASCRIPT", this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT", "PYTHON", "JAVA", "SCALA"] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = "TABLE_VALUED_FUNCTION".\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = "SQL"; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~>**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn't\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"]\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `spark_options` (`list[obj]`): Optional. If language is one of "PYTHON", "JAVA", "SCALA", this field stores the options for spark stored procedure. When `null`, the `spark_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.spark_options.new](#fn-spark_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_routine` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset_id,
     definition_body,
     routine_id,
+    routine_type,
     arguments=null,
     description=null,
     determinism_level=null,
@@ -66,7 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     return_table_type=null,
     return_type=null,
-    routine_type=null,
+    spark_options=null,
     timeouts=null
   ):: std.prune(a={
     arguments: arguments,
@@ -81,8 +84,35 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     return_type: return_type,
     routine_id: routine_id,
     routine_type: routine_type,
+    spark_options: spark_options,
     timeouts: timeouts,
   }),
+  spark_options:: {
+    '#new':: d.fn(help='\n`google.bigquery_routine.spark_options.new` constructs a new object with attributes and blocks configured for the `spark_options`\nTerraform sub block.\n\n\n\n**Args**:\n  - `archive_uris` (`list`): Archive files to be extracted into the working directory of each executor. For more information about Apache Spark, see Apache Spark. When `null`, the `archive_uris` field will be omitted from the resulting object.\n  - `connection` (`string`): Fully qualified name of the user-provided Spark connection object.\nFormat: "projects/{projectId}/locations/{locationId}/connections/{connectionId}" When `null`, the `connection` field will be omitted from the resulting object.\n  - `container_image` (`string`): Custom container image for the runtime environment. When `null`, the `container_image` field will be omitted from the resulting object.\n  - `file_uris` (`list`): Files to be placed in the working directory of each executor. For more information about Apache Spark, see Apache Spark. When `null`, the `file_uris` field will be omitted from the resulting object.\n  - `jar_uris` (`list`): JARs to include on the driver and executor CLASSPATH. For more information about Apache Spark, see Apache Spark. When `null`, the `jar_uris` field will be omitted from the resulting object.\n  - `main_class` (`string`): The fully qualified name of a class in jarUris, for example, com.example.wordcount.\nExactly one of mainClass and main_jar_uri field should be set for Java/Scala language type. When `null`, the `main_class` field will be omitted from the resulting object.\n  - `main_file_uri` (`string`): The main file/jar URI of the Spark application.\nExactly one of the definitionBody field and the mainFileUri field must be set for Python.\nExactly one of mainClass and mainFileUri field should be set for Java/Scala language type. When `null`, the `main_file_uri` field will be omitted from the resulting object.\n  - `properties` (`obj`): Configuration properties as a set of key/value pairs, which will be passed on to the Spark application.\nFor more information, see Apache Spark and the procedure option list.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `properties` field will be omitted from the resulting object.\n  - `py_file_uris` (`list`): Python files to be placed on the PYTHONPATH for PySpark application. Supported file types: .py, .egg, and .zip. For more information about Apache Spark, see Apache Spark. When `null`, the `py_file_uris` field will be omitted from the resulting object.\n  - `runtime_version` (`string`): Runtime version. If not specified, the default runtime version is used. When `null`, the `runtime_version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `spark_options` sub block.\n', args=[]),
+    new(
+      archive_uris=null,
+      connection=null,
+      container_image=null,
+      file_uris=null,
+      jar_uris=null,
+      main_class=null,
+      main_file_uri=null,
+      properties=null,
+      py_file_uris=null,
+      runtime_version=null
+    ):: std.prune(a={
+      archive_uris: archive_uris,
+      connection: connection,
+      container_image: container_image,
+      file_uris: file_uris,
+      jar_uris: jar_uris,
+      main_class: main_class,
+      main_file_uri: main_file_uri,
+      properties: properties,
+      py_file_uris: py_file_uris,
+      runtime_version: runtime_version,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.bigquery_routine.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -225,6 +255,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSparkOptions':: d.fn(help='`google.list[obj].withSparkOptions` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the spark_options field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSparkOptionsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `spark_options` field.\n', args=[]),
+  withSparkOptions(resourceLabel, value): {
+    resource+: {
+      google_bigquery_routine+: {
+        [resourceLabel]+: {
+          spark_options: value,
+        },
+      },
+    },
+  },
+  '#withSparkOptionsMixin':: d.fn(help='`google.list[obj].withSparkOptionsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the spark_options field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSparkOptions](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `spark_options` field.\n', args=[]),
+  withSparkOptionsMixin(resourceLabel, value): {
+    resource+: {
+      google_bigquery_routine+: {
+        [resourceLabel]+: {
+          spark_options+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/bigquery_table.libsonnet b/4.x/_gen/resources/bigquery_table.libsonnet
index fc97f2c7..5fba8c88 100644
--- a/4.x/_gen/resources/bigquery_table.libsonnet
+++ b/4.x/_gen/resources/bigquery_table.libsonnet
@@ -119,7 +119,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     },
   },
   materialized_view:: {
-    '#new':: d.fn(help='\n`google.bigquery_table.materialized_view.new` constructs a new object with attributes and blocks configured for the `materialized_view`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_non_incremental_definition` (`bool`): Allow non incremental materialized view definition. The default value is false. When `null`, the `allow_non_incremental_definition` field will be omitted from the resulting object.\n  - `enable_refresh` (`bool`): Specifies if BigQuery should automatically refresh materialized view when the base table is updated. The default is true. When `null`, the `enable_refresh` field will be omitted from the resulting object.\n  - `query` (`string`): A query whose result is persisted.\n  - `refresh_interval_ms` (`number`): Specifies maximum frequency at which this materialized view will be refreshed. The default is 1800000 When `null`, the `refresh_interval_ms` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `materialized_view` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.bigquery_table.materialized_view.new` constructs a new object with attributes and blocks configured for the `materialized_view`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_non_incremental_definition` (`bool`): Allow non incremental materialized view definition. The default value is false. When `null`, the `allow_non_incremental_definition` field will be omitted from the resulting object.\n  - `enable_refresh` (`bool`): Specifies if BigQuery should automatically refresh materialized view when the base table is updated. The default is true. When `null`, the `enable_refresh` field will be omitted from the resulting object.\n  - `query` (`string`): A query whose result is persisted.\n  - `refresh_interval_ms` (`number`): Specifies maximum frequency at which this materialized view will be refreshed. The default is 1800000. When `null`, the `refresh_interval_ms` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `materialized_view` sub block.\n', args=[]),
     new(
       query,
       allow_non_incremental_definition=null,
@@ -132,7 +132,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       refresh_interval_ms: refresh_interval_ms,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_table.new` injects a new `google_bigquery_table` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_table.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_table` using the reference:\n\n    $._ref.google_bigquery_table.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_table.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_table.new` injects a new `google_bigquery_table` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_table.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_table` using the reference:\n\n    $._ref.google_bigquery_table.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_table.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset_id,
@@ -149,6 +149,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_staleness=null,
     project=null,
     range_partitioning=null,
+    require_partition_filter=null,
     schema=null,
     table_constraints=null,
     time_partitioning=null,
@@ -171,6 +172,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       max_staleness=max_staleness,
       project=project,
       range_partitioning=range_partitioning,
+      require_partition_filter=require_partition_filter,
       schema=schema,
       table_constraints=table_constraints,
       table_id=table_id,
@@ -179,7 +181,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_table.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_table`\nTerraform resource.\n\nUnlike [google.bigquery_table.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_table` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_table.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_table`\nTerraform resource.\n\nUnlike [google.bigquery_table.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_table` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset_id,
     table_id,
@@ -195,6 +197,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_staleness=null,
     project=null,
     range_partitioning=null,
+    require_partition_filter=null,
     schema=null,
     table_constraints=null,
     time_partitioning=null,
@@ -213,6 +216,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_staleness: max_staleness,
     project: project,
     range_partitioning: range_partitioning,
+    require_partition_filter: require_partition_filter,
     schema: schema,
     table_constraints: table_constraints,
     table_id: table_id,
@@ -487,6 +491,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRequirePartitionFilter':: d.fn(help='`google.bool.withRequirePartitionFilter` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the require_partition_filter field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `require_partition_filter` field.\n', args=[]),
+  withRequirePartitionFilter(resourceLabel, value): {
+    resource+: {
+      google_bigquery_table+: {
+        [resourceLabel]+: {
+          require_partition_filter: value,
+        },
+      },
+    },
+  },
   '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
   withSchema(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/bigtable_app_profile.libsonnet b/4.x/_gen/resources/bigtable_app_profile.libsonnet
index bd79da27..387d3ea3 100644
--- a/4.x/_gen/resources/bigtable_app_profile.libsonnet
+++ b/4.x/_gen/resources/bigtable_app_profile.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='bigtable_app_profile', url='', help='`bigtable_app_profile` represents the `google_bigtable_app_profile` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.bigtable_app_profile.new` injects a new `google_bigtable_app_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigtable_app_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigtable_app_profile` using the reference:\n\n    $._ref.google_bigtable_app_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigtable_app_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_profile_id` (`string`): The unique name of the app profile in the form \u0026#39;[_a-zA-Z0-9][-_.a-zA-Z0-9]*\u0026#39;.\n  - `description` (`string`): Long form description of the use case for this app profile. When `null`, the `description` field will be omitted from the resulting object.\n  - `ignore_warnings` (`bool`): If true, ignore safety checks when deleting/updating the app profile. When `null`, the `ignore_warnings` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the instance to create the app profile within. When `null`, the `instance` field will be omitted from the resulting object.\n  - `multi_cluster_routing_cluster_ids` (`list`): The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible. When `null`, the `multi_cluster_routing_cluster_ids` field will be omitted from the resulting object.\n  - `multi_cluster_routing_use_any` (`bool`): If true, read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available\nin the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes\nconsistency to improve availability. When `null`, the `multi_cluster_routing_use_any` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `single_cluster_routing` (`list[obj]`): Use a single-cluster routing policy. When `null`, the `single_cluster_routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.single_cluster_routing.new](#fn-single_cluster_routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigtable_app_profile.new` injects a new `google_bigtable_app_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigtable_app_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigtable_app_profile` using the reference:\n\n    $._ref.google_bigtable_app_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigtable_app_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_profile_id` (`string`): The unique name of the app profile in the form \u0026#39;[_a-zA-Z0-9][-_.a-zA-Z0-9]*\u0026#39;.\n  - `description` (`string`): Long form description of the use case for this app profile. When `null`, the `description` field will be omitted from the resulting object.\n  - `ignore_warnings` (`bool`): If true, ignore safety checks when deleting/updating the app profile. When `null`, the `ignore_warnings` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the instance to create the app profile within. When `null`, the `instance` field will be omitted from the resulting object.\n  - `multi_cluster_routing_cluster_ids` (`list`): The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible. When `null`, the `multi_cluster_routing_cluster_ids` field will be omitted from the resulting object.\n  - `multi_cluster_routing_use_any` (`bool`): If true, read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available\nin the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes\nconsistency to improve availability. When `null`, the `multi_cluster_routing_use_any` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `single_cluster_routing` (`list[obj]`): Use a single-cluster routing policy. When `null`, the `single_cluster_routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.single_cluster_routing.new](#fn-single_cluster_routingnew) constructor.\n  - `standard_isolation` (`list[obj]`): The standard options used for isolating this app profile\u0026#39;s traffic from other use cases. When `null`, the `standard_isolation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.standard_isolation.new](#fn-standard_isolationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     app_profile_id,
@@ -13,6 +13,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     multi_cluster_routing_use_any=null,
     project=null,
     single_cluster_routing=null,
+    standard_isolation=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -27,11 +28,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       multi_cluster_routing_use_any=multi_cluster_routing_use_any,
       project=project,
       single_cluster_routing=single_cluster_routing,
+      standard_isolation=standard_isolation,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigtable_app_profile.newAttrs` constructs a new object with attributes and blocks configured for the `bigtable_app_profile`\nTerraform resource.\n\nUnlike [google.bigtable_app_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_profile_id` (`string`): The unique name of the app profile in the form '[_a-zA-Z0-9][-_.a-zA-Z0-9]*'.\n  - `description` (`string`): Long form description of the use case for this app profile. When `null`, the `description` field will be omitted from the resulting object.\n  - `ignore_warnings` (`bool`): If true, ignore safety checks when deleting/updating the app profile. When `null`, the `ignore_warnings` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the instance to create the app profile within. When `null`, the `instance` field will be omitted from the resulting object.\n  - `multi_cluster_routing_cluster_ids` (`list`): The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible. When `null`, the `multi_cluster_routing_cluster_ids` field will be omitted from the resulting object.\n  - `multi_cluster_routing_use_any` (`bool`): If true, read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available\nin the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes\nconsistency to improve availability. When `null`, the `multi_cluster_routing_use_any` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `single_cluster_routing` (`list[obj]`): Use a single-cluster routing policy. When `null`, the `single_cluster_routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.single_cluster_routing.new](#fn-single_cluster_routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigtable_app_profile` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigtable_app_profile.newAttrs` constructs a new object with attributes and blocks configured for the `bigtable_app_profile`\nTerraform resource.\n\nUnlike [google.bigtable_app_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_profile_id` (`string`): The unique name of the app profile in the form '[_a-zA-Z0-9][-_.a-zA-Z0-9]*'.\n  - `description` (`string`): Long form description of the use case for this app profile. When `null`, the `description` field will be omitted from the resulting object.\n  - `ignore_warnings` (`bool`): If true, ignore safety checks when deleting/updating the app profile. When `null`, the `ignore_warnings` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the instance to create the app profile within. When `null`, the `instance` field will be omitted from the resulting object.\n  - `multi_cluster_routing_cluster_ids` (`list`): The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible. When `null`, the `multi_cluster_routing_cluster_ids` field will be omitted from the resulting object.\n  - `multi_cluster_routing_use_any` (`bool`): If true, read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available\nin the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes\nconsistency to improve availability. When `null`, the `multi_cluster_routing_use_any` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `single_cluster_routing` (`list[obj]`): Use a single-cluster routing policy. When `null`, the `single_cluster_routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.single_cluster_routing.new](#fn-single_cluster_routingnew) constructor.\n  - `standard_isolation` (`list[obj]`): The standard options used for isolating this app profile's traffic from other use cases. When `null`, the `standard_isolation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.standard_isolation.new](#fn-standard_isolationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigtable_app_profile` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     app_profile_id,
     description=null,
@@ -41,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     multi_cluster_routing_use_any=null,
     project=null,
     single_cluster_routing=null,
+    standard_isolation=null,
     timeouts=null
   ):: std.prune(a={
     app_profile_id: app_profile_id,
@@ -51,6 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     multi_cluster_routing_use_any: multi_cluster_routing_use_any,
     project: project,
     single_cluster_routing: single_cluster_routing,
+    standard_isolation: standard_isolation,
     timeouts: timeouts,
   }),
   single_cluster_routing:: {
@@ -63,6 +67,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cluster_id: cluster_id,
     }),
   },
+  standard_isolation:: {
+    '#new':: d.fn(help='\n`google.bigtable_app_profile.standard_isolation.new` constructs a new object with attributes and blocks configured for the `standard_isolation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `priority` (`string`): The priority of requests sent using this app profile. Possible values: ["PRIORITY_LOW", "PRIORITY_MEDIUM", "PRIORITY_HIGH"]\n\n**Returns**:\n  - An attribute object that represents the `standard_isolation` sub block.\n', args=[]),
+    new(
+      priority
+    ):: std.prune(a={
+      priority: priority,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.bigtable_app_profile.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -165,6 +177,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStandardIsolation':: d.fn(help='`google.list[obj].withStandardIsolation` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the standard_isolation field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStandardIsolationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `standard_isolation` field.\n', args=[]),
+  withStandardIsolation(resourceLabel, value): {
+    resource+: {
+      google_bigtable_app_profile+: {
+        [resourceLabel]+: {
+          standard_isolation: value,
+        },
+      },
+    },
+  },
+  '#withStandardIsolationMixin':: d.fn(help='`google.list[obj].withStandardIsolationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the standard_isolation field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStandardIsolation](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `standard_isolation` field.\n', args=[]),
+  withStandardIsolationMixin(resourceLabel, value): {
+    resource+: {
+      google_bigtable_app_profile+: {
+        [resourceLabel]+: {
+          standard_isolation+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/bigtable_instance.libsonnet b/4.x/_gen/resources/bigtable_instance.libsonnet
index 368c9566..cfe17fe9 100644
--- a/4.x/_gen/resources/bigtable_instance.libsonnet
+++ b/4.x/_gen/resources/bigtable_instance.libsonnet
@@ -34,7 +34,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       zone: zone,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigtable_instance.new` injects a new `google_bigtable_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigtable_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigtable_instance` using the reference:\n\n    $._ref.google_bigtable_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigtable_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of \u0026#34;DEVELOPMENT\u0026#34; or \u0026#34;PRODUCTION\u0026#34;. Defaults to \u0026#34;PRODUCTION\u0026#34;. When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigtable_instance.new` injects a new `google_bigtable_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigtable_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigtable_instance` using the reference:\n\n    $._ref.google_bigtable_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigtable_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of \u0026#34;DEVELOPMENT\u0026#34; or \u0026#34;PRODUCTION\u0026#34;. Defaults to \u0026#34;PRODUCTION\u0026#34;. When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -61,7 +61,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigtable_instance.newAttrs` constructs a new object with attributes and blocks configured for the `bigtable_instance`\nTerraform resource.\n\nUnlike [google.bigtable_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigtable_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigtable_instance.newAttrs` constructs a new object with attributes and blocks configured for the `bigtable_instance`\nTerraform resource.\n\nUnlike [google.bigtable_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigtable_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     cluster=null,
diff --git a/4.x/_gen/resources/blockchain_node_engine_blockchain_nodes.libsonnet b/4.x/_gen/resources/blockchain_node_engine_blockchain_nodes.libsonnet
new file mode 100644
index 00000000..28b37c0a
--- /dev/null
+++ b/4.x/_gen/resources/blockchain_node_engine_blockchain_nodes.libsonnet
@@ -0,0 +1,188 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='blockchain_node_engine_blockchain_nodes', url='', help='`blockchain_node_engine_blockchain_nodes` represents the `google_blockchain_node_engine_blockchain_nodes` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  ethereum_details:: {
+    geth_details:: {
+      '#new':: d.fn(help='\n`google.blockchain_node_engine_blockchain_nodes.ethereum_details.geth_details.new` constructs a new object with attributes and blocks configured for the `geth_details`\nTerraform sub block.\n\n\n\n**Args**:\n  - `garbage_collection_mode` (`string`): Blockchain garbage collection modes. Only applicable when NodeType is FULL or ARCHIVE. Possible values: ["FULL", "ARCHIVE"] When `null`, the `garbage_collection_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `geth_details` sub block.\n', args=[]),
+      new(
+        garbage_collection_mode=null
+      ):: std.prune(a={
+        garbage_collection_mode: garbage_collection_mode,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.blockchain_node_engine_blockchain_nodes.ethereum_details.new` constructs a new object with attributes and blocks configured for the `ethereum_details`\nTerraform sub block.\n\n\n\n**Args**:\n  - `api_enable_admin` (`bool`): Enables JSON-RPC access to functions in the admin namespace. Defaults to false. When `null`, the `api_enable_admin` field will be omitted from the resulting object.\n  - `api_enable_debug` (`bool`): Enables JSON-RPC access to functions in the debug namespace. Defaults to false. When `null`, the `api_enable_debug` field will be omitted from the resulting object.\n  - `consensus_client` (`string`): The consensus client Possible values: ["CONSENSUS_CLIENT_UNSPECIFIED", "LIGHTHOUSE"] When `null`, the `consensus_client` field will be omitted from the resulting object.\n  - `execution_client` (`string`): The execution client Possible values: ["EXECUTION_CLIENT_UNSPECIFIED", "GETH", "ERIGON"] When `null`, the `execution_client` field will be omitted from the resulting object.\n  - `network` (`string`): The Ethereum environment being accessed. Possible values: ["MAINNET", "TESTNET_GOERLI_PRATER", "TESTNET_SEPOLIA"] When `null`, the `network` field will be omitted from the resulting object.\n  - `node_type` (`string`): The type of Ethereum node. Possible values: ["LIGHT", "FULL", "ARCHIVE"] When `null`, the `node_type` field will be omitted from the resulting object.\n  - `geth_details` (`list[obj]`): User-provided key-value pairs When `null`, the `geth_details` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.geth_details.new](#fn-ethereum_detailsgeth_detailsnew) constructor.\n  - `validator_config` (`list[obj]`): Configuration for validator-related parameters on the beacon client, and for any managed validator client. When `null`, the `validator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.validator_config.new](#fn-ethereum_detailsvalidator_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ethereum_details` sub block.\n', args=[]),
+    new(
+      api_enable_admin=null,
+      api_enable_debug=null,
+      consensus_client=null,
+      execution_client=null,
+      geth_details=null,
+      network=null,
+      node_type=null,
+      validator_config=null
+    ):: std.prune(a={
+      api_enable_admin: api_enable_admin,
+      api_enable_debug: api_enable_debug,
+      consensus_client: consensus_client,
+      execution_client: execution_client,
+      geth_details: geth_details,
+      network: network,
+      node_type: node_type,
+      validator_config: validator_config,
+    }),
+    validator_config:: {
+      '#new':: d.fn(help='\n`google.blockchain_node_engine_blockchain_nodes.ethereum_details.validator_config.new` constructs a new object with attributes and blocks configured for the `validator_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mev_relay_urls` (`list`): URLs for MEV-relay services to use for block building. When set, a managed MEV-boost service is configured on the beacon client. When `null`, the `mev_relay_urls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `validator_config` sub block.\n', args=[]),
+      new(
+        mev_relay_urls=null
+      ):: std.prune(a={
+        mev_relay_urls: mev_relay_urls,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.blockchain_node_engine_blockchain_nodes.new` injects a new `google_blockchain_node_engine_blockchain_nodes` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.blockchain_node_engine_blockchain_nodes.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.blockchain_node_engine_blockchain_nodes` using the reference:\n\n    $._ref.google_blockchain_node_engine_blockchain_nodes.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_blockchain_node_engine_blockchain_nodes.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `blockchain_node_id` (`string`): ID of the requesting object.\n  - `blockchain_type` (`string`): User-provided key-value pairs Possible values: [\u0026#34;ETHEREUM\u0026#34;] When `null`, the `blockchain_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-provided key-value pairs\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of Blockchain Node being created.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `ethereum_details` (`list[obj]`): User-provided key-value pairs When `null`, the `ethereum_details` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.new](#fn-ethereum_detailsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    blockchain_node_id,
+    location,
+    blockchain_type=null,
+    ethereum_details=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_blockchain_node_engine_blockchain_nodes',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      blockchain_node_id=blockchain_node_id,
+      blockchain_type=blockchain_type,
+      ethereum_details=ethereum_details,
+      labels=labels,
+      location=location,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.blockchain_node_engine_blockchain_nodes.newAttrs` constructs a new object with attributes and blocks configured for the `blockchain_node_engine_blockchain_nodes`\nTerraform resource.\n\nUnlike [google.blockchain_node_engine_blockchain_nodes.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `blockchain_node_id` (`string`): ID of the requesting object.\n  - `blockchain_type` (`string`): User-provided key-value pairs Possible values: ["ETHEREUM"] When `null`, the `blockchain_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-provided key-value pairs\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of Blockchain Node being created.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `ethereum_details` (`list[obj]`): User-provided key-value pairs When `null`, the `ethereum_details` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.new](#fn-ethereum_detailsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `blockchain_node_engine_blockchain_nodes` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    blockchain_node_id,
+    location,
+    blockchain_type=null,
+    ethereum_details=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    blockchain_node_id: blockchain_node_id,
+    blockchain_type: blockchain_type,
+    ethereum_details: ethereum_details,
+    labels: labels,
+    location: location,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.blockchain_node_engine_blockchain_nodes.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withBlockchainNodeId':: d.fn(help='`google.string.withBlockchainNodeId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the blockchain_node_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `blockchain_node_id` field.\n', args=[]),
+  withBlockchainNodeId(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          blockchain_node_id: value,
+        },
+      },
+    },
+  },
+  '#withBlockchainType':: d.fn(help='`google.string.withBlockchainType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the blockchain_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `blockchain_type` field.\n', args=[]),
+  withBlockchainType(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          blockchain_type: value,
+        },
+      },
+    },
+  },
+  '#withEthereumDetails':: d.fn(help='`google.list[obj].withEthereumDetails` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ethereum_details field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEthereumDetailsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ethereum_details` field.\n', args=[]),
+  withEthereumDetails(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          ethereum_details: value,
+        },
+      },
+    },
+  },
+  '#withEthereumDetailsMixin':: d.fn(help='`google.list[obj].withEthereumDetailsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ethereum_details field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEthereumDetails](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ethereum_details` field.\n', args=[]),
+  withEthereumDetailsMixin(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          ethereum_details+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_blockchain_node_engine_blockchain_nodes+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/certificate_manager_certificate.libsonnet b/4.x/_gen/resources/certificate_manager_certificate.libsonnet
index c0e02d0a..78ad9ee5 100644
--- a/4.x/_gen/resources/certificate_manager_certificate.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate.libsonnet
@@ -14,7 +14,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       issuance_config: issuance_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate.new` injects a new `google_certificate_manager_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate` using the reference:\n\n    $._ref.google_certificate_manager_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,\nserved from non-core Google data centers.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nsee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it\u0026#39;s authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user\u0026#39;s responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate.new` injects a new `google_certificate_manager_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate` using the reference:\n\n    $._ref.google_certificate_manager_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.\nSee https://cloud.google.com/vpc/docs/edge-locations.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nSee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it\u0026#39;s authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user\u0026#39;s responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -43,7 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,\nserved from non-core Google data centers.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nsee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user's responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.\nSee https://cloud.google.com/vpc/docs/edge-locations.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nSee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user's responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
index 8cee0053..3cea408e 100644
--- a/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       certificate_authority_service_config: certificate_authority_service_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate_issuance_config.new` injects a new `google_certificate_manager_certificate_issuance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_issuance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_issuance_config` using the reference:\n\n    $._ref.google_certificate_manager_certificate_issuance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_issuance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: [\u0026#34;RSA_2048\u0026#34;, \u0026#34;ECDSA_P256\u0026#34;]\n  - `labels` (`obj`): \u0026#39;Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;.\nExample: \u0026#34;1814400s\u0026#34;. Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_issuance_config.new` injects a new `google_certificate_manager_certificate_issuance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_issuance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_issuance_config` using the reference:\n\n    $._ref.google_certificate_manager_certificate_issuance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_issuance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: [\u0026#34;RSA_2048\u0026#34;, \u0026#34;ECDSA_P256\u0026#34;]\n  - `labels` (`obj`): \u0026#39;Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;.\nExample: \u0026#34;1814400s\u0026#34;. Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     key_algorithm,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_issuance_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_issuance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]\n  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.\nExample: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_issuance_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_issuance_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_issuance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]\n  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.\nExample: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_issuance_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     key_algorithm,
     lifetime,
@@ -74,13 +74,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withCertificateAuthorityConfig':: d.fn(help='`google.list[obj].withCertificateAuthorityConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the certificate_authority_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCertificateAuthorityConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `certificate_authority_config` field.\n', args=[]),
diff --git a/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet
index eef2c992..63ed3509 100644
--- a/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_certificate_map', url='', help='`certificate_manager_certificate_map` represents the `google_certificate_manager_certificate_map` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map.new` injects a new `google_certificate_manager_certificate_map` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern \u0026#39;projects/*/locations/*/certificateMaps/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map.new` injects a new `google_certificate_manager_certificate_map` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern \u0026#39;projects/*/locations/*/certificateMaps/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern 'projects/*/locations/*/certificateMaps/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern 'projects/*/locations/*/certificateMaps/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet
index 171ffaf9..eab868aa 100644
--- a/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_certificate_map_entry', url='', help='`certificate_manager_certificate_map_entry` represents the `google_certificate_manager_certificate_map_entry` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map_entry.new` injects a new `google_certificate_manager_certificate_map_entry` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map_entry.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map_entry` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map_entry.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map_entry.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n\u0026#39;projects/*/locations/*/certificateMaps/*/certificateMapEntries/*\u0026#39;\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map_entry.new` injects a new `google_certificate_manager_certificate_map_entry` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map_entry.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map_entry` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map_entry.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map_entry.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n\u0026#39;projects/*/locations/*/certificateMaps/*/certificateMapEntries/*\u0026#39;\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     certificates,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map_entry.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map_entry`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map_entry.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n'projects/*/locations/*/certificateMaps/*/certificateMapEntries/*'\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map_entry` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map_entry.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map_entry`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map_entry.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n'projects/*/locations/*/certificateMaps/*/certificateMapEntries/*'\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map_entry` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     certificates,
     map,
diff --git a/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet b/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet
index 99d2a0f8..e5b4a26a 100644
--- a/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_dns_authorization', url='', help='`certificate_manager_dns_authorization` represents the `google_certificate_manager_dns_authorization` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_dns_authorization.new` injects a new `google_certificate_manager_dns_authorization` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_dns_authorization.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_dns_authorization` using the reference:\n\n    $._ref.google_certificate_manager_dns_authorization.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_dns_authorization.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for \u0026#34;example.com\u0026#34; can\nbe used to issue certificates for \u0026#34;example.com\u0026#34; and \u0026#34;*.example.com\u0026#34;.\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_dns_authorization.new` injects a new `google_certificate_manager_dns_authorization` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_dns_authorization.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_dns_authorization` using the reference:\n\n    $._ref.google_certificate_manager_dns_authorization.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_dns_authorization.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for \u0026#34;example.com\u0026#34; can\nbe used to issue certificates for \u0026#34;example.com\u0026#34; and \u0026#34;*.example.com\u0026#34;.\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     domain,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_dns_authorization.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_dns_authorization`\nTerraform resource.\n\nUnlike [google.certificate_manager_dns_authorization.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for "example.com" can\nbe used to issue certificates for "example.com" and "*.example.com".\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_dns_authorization` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_dns_authorization.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_dns_authorization`\nTerraform resource.\n\nUnlike [google.certificate_manager_dns_authorization.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for "example.com" can\nbe used to issue certificates for "example.com" and "*.example.com".\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_dns_authorization` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     domain,
     name,
diff --git a/4.x/_gen/resources/certificate_manager_trust_config.libsonnet b/4.x/_gen/resources/certificate_manager_trust_config.libsonnet
index c44d9704..91dc1356 100644
--- a/4.x/_gen/resources/certificate_manager_trust_config.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_trust_config.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_trust_config', url='', help='`certificate_manager_trust_config` represents the `google_certificate_manager_trust_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_trust_config.new` injects a new `google_certificate_manager_trust_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_trust_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_trust_config` using the reference:\n\n    $._ref.google_certificate_manager_trust_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_trust_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_trust_config.new` injects a new `google_certificate_manager_trust_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_trust_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_trust_config` using the reference:\n\n    $._ref.google_certificate_manager_trust_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_trust_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_trust_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_trust_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_trust_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_trust_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_trust_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_trust_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_trust_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_trust_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloud_identity_group_membership.libsonnet b/4.x/_gen/resources/cloud_identity_group_membership.libsonnet
index 05615af2..c95347c7 100644
--- a/4.x/_gen/resources/cloud_identity_group_membership.libsonnet
+++ b/4.x/_gen/resources/cloud_identity_group_membership.libsonnet
@@ -42,10 +42,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   roles:: {
-    '#new':: d.fn(help='\n`google.cloud_identity_group_membership.roles.new` constructs a new object with attributes and blocks configured for the `roles`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The name of the MembershipRole. Must be one of OWNER, MANAGER, MEMBER. Possible values: ["OWNER", "MANAGER", "MEMBER"]\n\n**Returns**:\n  - An attribute object that represents the `roles` sub block.\n', args=[]),
+    expiry_detail:: {
+      '#new':: d.fn(help='\n`google.cloud_identity_group_membership.roles.expiry_detail.new` constructs a new object with attributes and blocks configured for the `expiry_detail`\nTerraform sub block.\n\n\n\n**Args**:\n  - `expire_time` (`string`): The time at which the MembershipRole will expire.\n\nA timestamp in RFC3339 UTC "Zulu" format, with nanosecond\nresolution and up to nine fractional digits.\n\nExamples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".\n\n**Returns**:\n  - An attribute object that represents the `expiry_detail` sub block.\n', args=[]),
+      new(
+        expire_time
+      ):: std.prune(a={
+        expire_time: expire_time,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.cloud_identity_group_membership.roles.new` constructs a new object with attributes and blocks configured for the `roles`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The name of the MembershipRole. Must be one of OWNER, MANAGER, MEMBER. Possible values: ["OWNER", "MANAGER", "MEMBER"]\n  - `expiry_detail` (`list[obj]`): The MembershipRole expiry details, only supported for MEMBER role.\nOther roles cannot be accompanied with MEMBER role having expiry. When `null`, the `expiry_detail` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_identity_group_membership.roles.expiry_detail.new](#fn-rolesexpiry_detailnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `roles` sub block.\n', args=[]),
     new(
-      name
+      name,
+      expiry_detail=null
     ):: std.prune(a={
+      expiry_detail: expiry_detail,
       name: name,
     }),
   },
diff --git a/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet b/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet
index 8d635695..bcce33a6 100644
--- a/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet
+++ b/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet
@@ -3,7 +3,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='cloud_run_domain_mapping', url='', help='`cloud_run_domain_mapping` represents the `google_cloud_run_domain_mapping` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   metadata:: {
-    '#new':: d.fn(help='\n`google.cloud_run_domain_mapping.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.cloud_run_domain_mapping.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
     new(
       namespace,
       annotations=null,
diff --git a/4.x/_gen/resources/cloud_run_service.libsonnet b/4.x/_gen/resources/cloud_run_service.libsonnet
index 79d220c4..6c1d5a08 100644
--- a/4.x/_gen/resources/cloud_run_service.libsonnet
+++ b/4.x/_gen/resources/cloud_run_service.libsonnet
@@ -3,7 +3,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='cloud_run_service', url='', help='`cloud_run_service` represents the `google_cloud_run_service` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   metadata:: {
-    '#new':: d.fn(help='\n`google.cloud_run_service.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.\n\nAnnotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation\nkeys to configure features on a Service:\n\n- 'run.googleapis.com/binary-authorization-breakglass' sets the [Binary Authorization breakglass](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--breakglass).\n- 'run.googleapis.com/binary-authorization' sets the [Binary Authorization](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--binary-authorization).\n- 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.\n- 'run.googleapis.com/custom-audiences' sets the [custom audiences](https://cloud.google.com/sdk/gcloud/reference/alpha/run/deploy#--add-custom-audiences)\n  that can be used in the audience field of ID token for authenticated requests.\n- 'run.googleapis.com/description' sets a user defined description for the Service.\n- 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)\n  for the Service. For example, '"run.googleapis.com/ingress" = "all"'.\n- 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)\n  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"' When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number. When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.cloud_run_service.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.\n\nAnnotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation\nkeys to configure features on a Service:\n\n- 'run.googleapis.com/binary-authorization-breakglass' sets the [Binary Authorization breakglass](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--breakglass).\n- 'run.googleapis.com/binary-authorization' sets the [Binary Authorization](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--binary-authorization).\n- 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.\n- 'run.googleapis.com/custom-audiences' sets the [custom audiences](https://cloud.google.com/sdk/gcloud/reference/alpha/run/deploy#--add-custom-audiences)\n  that can be used in the audience field of ID token for authenticated requests.\n- 'run.googleapis.com/description' sets a user defined description for the Service.\n- 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)\n  for the Service. For example, '"run.googleapis.com/ingress" = "all"'.\n- 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)\n  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"'\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number. When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
     new(
       annotations=null,
       labels=null,
diff --git a/4.x/_gen/resources/cloud_run_v2_job.libsonnet b/4.x/_gen/resources/cloud_run_v2_job.libsonnet
index e5334e89..62ad5b1a 100644
--- a/4.x/_gen/resources/cloud_run_v2_job.libsonnet
+++ b/4.x/_gen/resources/cloud_run_v2_job.libsonnet
@@ -12,9 +12,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       use_default: use_default,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloud_run_v2_job.new` injects a new `google_cloud_run_v2_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_job` using the reference:\n\n    $._ref.google_cloud_run_v2_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloud_run_v2_job.new` injects a new `google_cloud_run_v2_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_job` using the reference:\n\n    $._ref.google_cloud_run_v2_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    location,
     name,
     annotations=null,
     binary_authorization=null,
@@ -22,7 +23,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     client_version=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null,
@@ -45,8 +45,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    location,
     name,
     annotations=null,
     binary_authorization=null,
@@ -54,7 +55,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     client_version=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null
@@ -118,63 +118,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             },
           },
         },
-        liveness_probe:: {
-          http_get:: {
-            http_headers:: {
-              '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The header field name\n  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `http_headers` sub block.\n', args=[]),
-              new(
-                name,
-                value=null
-              ):: std.prune(a={
-                name: name,
-                value: value,
-              }),
-            },
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.\n  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersliveness_probehttp_headersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `http_get` sub block.\n', args=[]),
-            new(
-              http_headers=null,
-              path=null
-            ):: std.prune(a={
-              http_headers: http_headers,
-              path: path,
-            }),
-          },
-          '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `liveness_probe` sub block.\n', args=[]),
-          new(
-            failure_threshold=null,
-            http_get=null,
-            initial_delay_seconds=null,
-            period_seconds=null,
-            tcp_socket=null,
-            timeout_seconds=null
-          ):: std.prune(a={
-            failure_threshold: failure_threshold,
-            http_get: http_get,
-            initial_delay_seconds: initial_delay_seconds,
-            period_seconds: period_seconds,
-            tcp_socket: tcp_socket,
-            timeout_seconds: timeout_seconds,
-          }),
-          tcp_socket:: {
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
-            new(
-              port=null
-            ):: std.prune(a={
-              port: port,
-            }),
-          },
-        },
-        '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.env.new](#fn-templatetemplatetemplateenvnew) constructor.\n  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes\nThis field is not supported in Cloud Run Job currently. When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.new](#fn-templatetemplatetemplateliveness_probenew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.ports.new](#fn-templatetemplatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.resources.new](#fn-templatetemplatetemplateresourcesnew) constructor.\n  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes\nThis field is not supported in Cloud Run Job currently. When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.new](#fn-templatetemplatetemplatestartup_probenew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.volume_mounts.new](#fn-templatetemplatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.env.new](#fn-templatetemplatetemplateenvnew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.ports.new](#fn-templatetemplatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.resources.new](#fn-templatetemplatetemplateresourcesnew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.volume_mounts.new](#fn-templatetemplatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
         new(
           image,
           args=null,
           command=null,
           env=null,
-          liveness_probe=null,
           name=null,
           ports=null,
           resources=null,
-          startup_probe=null,
           volume_mounts=null,
           working_dir=null
         ):: std.prune(a={
@@ -182,11 +134,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           command: command,
           env: env,
           image: image,
-          liveness_probe: liveness_probe,
           name: name,
           ports: ports,
           resources: resources,
-          startup_probe: startup_probe,
           volume_mounts: volume_mounts,
           working_dir: working_dir,
         }),
@@ -201,59 +151,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           }),
         },
         resources:: {
-          '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.resources.new` constructs a new object with attributes and blocks configured for the `resources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `limits` (`obj`): Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resources` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.resources.new` constructs a new object with attributes and blocks configured for the `resources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `limits` (`obj`): Only memory and CPU are supported. Use key 'cpu' for CPU limit and 'memory' for memory limit. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resources` sub block.\n', args=[]),
           new(
             limits=null
           ):: std.prune(a={
             limits: limits,
           }),
         },
-        startup_probe:: {
-          http_get:: {
-            http_headers:: {
-              '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The header field name\n  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `http_headers` sub block.\n', args=[]),
-              new(
-                name,
-                value=null
-              ):: std.prune(a={
-                name: name,
-                value: value,
-              }),
-            },
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.\n  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersstartup_probehttp_headersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `http_get` sub block.\n', args=[]),
-            new(
-              http_headers=null,
-              path=null
-            ):: std.prune(a={
-              http_headers: http_headers,
-              path: path,
-            }),
-          },
-          '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.new` constructs a new object with attributes and blocks configured for the `startup_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `startup_probe` sub block.\n', args=[]),
-          new(
-            failure_threshold=null,
-            http_get=null,
-            initial_delay_seconds=null,
-            period_seconds=null,
-            tcp_socket=null,
-            timeout_seconds=null
-          ):: std.prune(a={
-            failure_threshold: failure_threshold,
-            http_get: http_get,
-            initial_delay_seconds: initial_delay_seconds,
-            period_seconds: period_seconds,
-            tcp_socket: tcp_socket,
-            timeout_seconds: timeout_seconds,
-          }),
-          tcp_socket:: {
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
-            new(
-              port=null
-            ):: std.prune(a={
-              port: port,
-            }),
-          },
-        },
         volume_mounts:: {
           '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.volume_mounts.new` constructs a new object with attributes and blocks configured for the `volume_mounts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mount_path` (`string`): Path within the container at which the volume should be mounted. Must not contain ':'. For Cloud SQL volumes, it can be left empty, or must otherwise be /cloudsql. All instances defined in the Volume will be available as /cloudsql/[instance]. For more information on Cloud SQL volumes, visit https://cloud.google.com/sql/docs/mysql/connect-run\n  - `name` (`string`): This must match the Name of a Volume.\n\n**Returns**:\n  - An attribute object that represents the `volume_mounts` sub block.\n', args=[]),
           new(
diff --git a/4.x/_gen/resources/cloud_run_v2_service.libsonnet b/4.x/_gen/resources/cloud_run_v2_service.libsonnet
index 38f6cea8..6f33b352 100644
--- a/4.x/_gen/resources/cloud_run_v2_service.libsonnet
+++ b/4.x/_gen/resources/cloud_run_v2_service.libsonnet
@@ -12,19 +12,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       use_default: use_default,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloud_run_v2_service.new` injects a new `google_cloud_run_v2_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_service` using the reference:\n\n    $._ref.google_cloud_run_v2_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: [\u0026#34;INGRESS_TRAFFIC_ALL\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_ONLY\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER\u0026#34;] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloud_run_v2_service.new` injects a new `google_cloud_run_v2_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_service` using the reference:\n\n    $._ref.google_cloud_run_v2_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `custom_audiences` (`list`): One or more custom audiences that you want this service to support. Specify each custom audience as the full URL in a string. The custom audiences are encoded in the token and used to authenticate requests.\nFor more information, see https://cloud.google.com/run/docs/configuring/custom-audiences. When `null`, the `custom_audiences` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: [\u0026#34;INGRESS_TRAFFIC_ALL\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_ONLY\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER\u0026#34;] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    location,
     name,
     annotations=null,
     binary_authorization=null,
     client=null,
     client_version=null,
+    custom_audiences=null,
     description=null,
     ingress=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null,
@@ -38,6 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       binary_authorization=binary_authorization,
       client=client,
       client_version=client_version,
+      custom_audiences=custom_audiences,
       description=description,
       ingress=ingress,
       labels=labels,
@@ -51,18 +53,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: ["INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `custom_audiences` (`list`): One or more custom audiences that you want this service to support. Specify each custom audience as the full URL in a string. The custom audiences are encoded in the token and used to authenticate requests.\nFor more information, see https://cloud.google.com/run/docs/configuring/custom-audiences. When `null`, the `custom_audiences` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: ["INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    location,
     name,
     annotations=null,
     binary_authorization=null,
     client=null,
     client_version=null,
+    custom_audiences=null,
     description=null,
     ingress=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null,
@@ -72,6 +75,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     binary_authorization: binary_authorization,
     client: client,
     client_version: client_version,
+    custom_audiences: custom_audiences,
     description: description,
     ingress: ingress,
     labels: labels,
@@ -148,7 +152,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             port: port,
           }),
         },
-        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `grpc` (`list[obj]`): GRPC specifies an action involving a GRPC port. When `null`, the `grpc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.grpc.new](#fn-templatetemplatecontainersgrpcnew) constructor.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.http_get.new](#fn-templatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. This field is not supported in liveness probe currently. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `liveness_probe` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `grpc` (`list[obj]`): GRPC specifies an action involving a GRPC port. When `null`, the `grpc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.grpc.new](#fn-templatetemplatecontainersgrpcnew) constructor.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.http_get.new](#fn-templatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocketAction describes an action based on opening a socket When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `liveness_probe` sub block.\n', args=[]),
         new(
           failure_threshold=null,
           grpc=null,
@@ -167,19 +171,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           timeout_seconds: timeout_seconds,
         }),
         tcp_socket:: {
-          '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535.\nIf not specified, defaults to the exposed port of the container, which\nis the value of container.ports[0].containerPort.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
           new(
-            port=null
+            port
           ):: std.prune(a={
             port: port,
           }),
         },
       },
-      '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.env.new](#fn-templatetemplateenvnew) constructor.\n  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.new](#fn-templatetemplateliveness_probenew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.ports.new](#fn-templatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.resources.new](#fn-templatetemplateresourcesnew) constructor.\n  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.startup_probe.new](#fn-templatetemplatestartup_probenew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.volume_mounts.new](#fn-templatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `depends_on` (`list`): Containers which should be started before this container. If specified the container will wait to start until all containers with the listed names are healthy. When `null`, the `depends_on` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.env.new](#fn-templatetemplateenvnew) constructor.\n  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.new](#fn-templatetemplateliveness_probenew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.ports.new](#fn-templatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.resources.new](#fn-templatetemplateresourcesnew) constructor.\n  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.startup_probe.new](#fn-templatetemplatestartup_probenew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.volume_mounts.new](#fn-templatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
       new(
         image,
         args=null,
         command=null,
+        depends_on=null,
         env=null,
         liveness_probe=null,
         name=null,
@@ -191,6 +196,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       ):: std.prune(a={
         args: args,
         command: command,
+        depends_on: depends_on,
         env: env,
         image: image,
         liveness_probe: liveness_probe,
@@ -212,7 +218,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
       resources:: {
-        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.resources.new` constructs a new object with attributes and blocks configured for the `resources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu_idle` (`bool`): Determines whether CPU should be throttled or not outside of requests. When `null`, the `cpu_idle` field will be omitted from the resulting object.\n  - `limits` (`obj`): Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.\n  - `startup_cpu_boost` (`bool`): Determines whether CPU should be boosted on startup of a new container instance above the requested CPU threshold, this can help reduce cold-start latency. When `null`, the `startup_cpu_boost` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resources` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.resources.new` constructs a new object with attributes and blocks configured for the `resources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu_idle` (`bool`): Determines whether CPU should be throttled or not outside of requests. When `null`, the `cpu_idle` field will be omitted from the resulting object.\n  - `limits` (`obj`): Only memory and CPU are supported. Use key 'cpu' for CPU limit and 'memory' for memory limit. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.\n  - `startup_cpu_boost` (`bool`): Determines whether CPU should be boosted on startup of a new container instance above the requested CPU threshold, this can help reduce cold-start latency. When `null`, the `startup_cpu_boost` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resources` sub block.\n', args=[]),
         new(
           cpu_idle=null,
           limits=null,
@@ -343,16 +349,42 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           instances: instances,
         }),
       },
-      '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.volumes.new` constructs a new object with attributes and blocks configured for the `volumes`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Volume's name.\n  - `cloud_sql_instance` (`list[obj]`): For Cloud SQL volumes, contains the specific instances that should be mounted. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run. When `null`, the `cloud_sql_instance` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.cloud_sql_instance.new](#fn-templatetemplatecloud_sql_instancenew) constructor.\n  - `secret` (`list[obj]`): Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret When `null`, the `secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.secret.new](#fn-templatetemplatesecretnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `volumes` sub block.\n', args=[]),
+      gcs:: {
+        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.volumes.gcs.new` constructs a new object with attributes and blocks configured for the `gcs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bucket` (`string`): GCS Bucket name\n  - `read_only` (`bool`): If true, mount the GCS bucket as read-only When `null`, the `read_only` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `gcs` sub block.\n', args=[]),
+        new(
+          bucket,
+          read_only=null
+        ):: std.prune(a={
+          bucket: bucket,
+          read_only: read_only,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.volumes.new` constructs a new object with attributes and blocks configured for the `volumes`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Volume's name.\n  - `cloud_sql_instance` (`list[obj]`): For Cloud SQL volumes, contains the specific instances that should be mounted. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run. When `null`, the `cloud_sql_instance` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.cloud_sql_instance.new](#fn-templatetemplatecloud_sql_instancenew) constructor.\n  - `gcs` (`list[obj]`): Represents a GCS Bucket mounted as a volume. When `null`, the `gcs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.gcs.new](#fn-templatetemplategcsnew) constructor.\n  - `nfs` (`list[obj]`): Represents an NFS mount. When `null`, the `nfs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.nfs.new](#fn-templatetemplatenfsnew) constructor.\n  - `secret` (`list[obj]`): Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret When `null`, the `secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.secret.new](#fn-templatetemplatesecretnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `volumes` sub block.\n', args=[]),
       new(
         name,
         cloud_sql_instance=null,
+        gcs=null,
+        nfs=null,
         secret=null
       ):: std.prune(a={
         cloud_sql_instance: cloud_sql_instance,
+        gcs: gcs,
         name: name,
+        nfs: nfs,
         secret: secret,
       }),
+      nfs:: {
+        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.volumes.nfs.new` constructs a new object with attributes and blocks configured for the `nfs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): Path that is exported by the NFS server.\n  - `read_only` (`bool`): If true, mount the NFS volume as read only When `null`, the `read_only` field will be omitted from the resulting object.\n  - `server` (`string`): Hostname or IP address of the NFS server\n\n**Returns**:\n  - An attribute object that represents the `nfs` sub block.\n', args=[]),
+        new(
+          path,
+          server,
+          read_only=null
+        ):: std.prune(a={
+          path: path,
+          read_only: read_only,
+          server: server,
+        }),
+      },
       secret:: {
         items:: {
           '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.volumes.secret.items.new` constructs a new object with attributes and blocks configured for the `items`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`number`): Integer octal mode bits to use on this file, must be a value between 01 and 0777 (octal). If 0 or not set, the Volume's default mode will be used. When `null`, the `mode` field will be omitted from the resulting object.\n  - `path` (`string`): The relative path of the secret in the container.\n  - `version` (`string`): The Cloud Secret Manager secret version. Can be 'latest' for the latest value or an integer for a specific version When `null`, the `version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `items` sub block.\n', args=[]),
@@ -479,6 +511,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withCustomAudiences':: d.fn(help='`google.list.withCustomAudiences` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the custom_audiences field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `custom_audiences` field.\n', args=[]),
+  withCustomAudiences(resourceLabel, value): {
+    resource+: {
+      google_cloud_run_v2_service+: {
+        [resourceLabel]+: {
+          custom_audiences: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/cloudbuild_trigger.libsonnet b/4.x/_gen/resources/cloudbuild_trigger.libsonnet
index 5725708f..c6b6c38a 100644
--- a/4.x/_gen/resources/cloudbuild_trigger.libsonnet
+++ b/4.x/_gen/resources/cloudbuild_trigger.libsonnet
@@ -52,14 +52,46 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   },
   build:: {
     artifacts:: {
-      '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.artifacts.new` constructs a new object with attributes and blocks configured for the `artifacts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `images` (`list`): A list of images to be pushed upon the successful completion of all build steps.\n\nThe images will be pushed using the builder service account's credentials.\n\nThe digests of the pushed images will be stored in the Build resource's results field.\n\nIf any of the images fail to be pushed, the build is marked FAILURE. When `null`, the `images` field will be omitted from the resulting object.\n  - `objects` (`list[obj]`): A list of objects to be uploaded to Cloud Storage upon successful completion of all build steps.\n\nFiles in the workspace matching specified paths globs will be uploaded to the\nCloud Storage location using the builder service account's credentials.\n\nThe location and generation of the uploaded objects will be stored in the Build resource's results field.\n\nIf any objects fail to be pushed, the build is marked FAILURE. When `null`, the `objects` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.objects.new](#fn-buildbuildobjectsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `artifacts` sub block.\n', args=[]),
+      maven_artifacts:: {
+        '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.artifacts.maven_artifacts.new` constructs a new object with attributes and blocks configured for the `maven_artifacts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `artifact_id` (`string`): Maven artifactId value used when uploading the artifact to Artifact Registry. When `null`, the `artifact_id` field will be omitted from the resulting object.\n  - `group_id` (`string`): Maven groupId value used when uploading the artifact to Artifact Registry. When `null`, the `group_id` field will be omitted from the resulting object.\n  - `path` (`string`): Path to an artifact in the build's workspace to be uploaded to Artifact Registry. This can be either an absolute path, e.g. /workspace/my-app/target/my-app-1.0.SNAPSHOT.jar or a relative path from /workspace, e.g. my-app/target/my-app-1.0.SNAPSHOT.jar. When `null`, the `path` field will be omitted from the resulting object.\n  - `repository` (`string`): Artifact Registry repository, in the form "https://$REGION-maven.pkg.dev/$PROJECT/$REPOSITORY"\n\nArtifact in the workspace specified by path will be uploaded to Artifact Registry with this location as a prefix. When `null`, the `repository` field will be omitted from the resulting object.\n  - `version` (`string`): Maven version value used when uploading the artifact to Artifact Registry. When `null`, the `version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `maven_artifacts` sub block.\n', args=[]),
+        new(
+          artifact_id=null,
+          group_id=null,
+          path=null,
+          repository=null,
+          version=null
+        ):: std.prune(a={
+          artifact_id: artifact_id,
+          group_id: group_id,
+          path: path,
+          repository: repository,
+          version: version,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.artifacts.new` constructs a new object with attributes and blocks configured for the `artifacts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `images` (`list`): A list of images to be pushed upon the successful completion of all build steps.\n\nThe images will be pushed using the builder service account's credentials.\n\nThe digests of the pushed images will be stored in the Build resource's results field.\n\nIf any of the images fail to be pushed, the build is marked FAILURE. When `null`, the `images` field will be omitted from the resulting object.\n  - `maven_artifacts` (`list[obj]`): A Maven artifact to upload to Artifact Registry upon successful completion of all build steps.\n\nThe location and generation of the uploaded objects will be stored in the Build resource's results field.\n\nIf any objects fail to be pushed, the build is marked FAILURE. When `null`, the `maven_artifacts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.maven_artifacts.new](#fn-buildbuildmaven_artifactsnew) constructor.\n  - `npm_packages` (`list[obj]`): Npm package to upload to Artifact Registry upon successful completion of all build steps.\n\nThe location and generation of the uploaded objects will be stored in the Build resource's results field.\n\nIf any objects fail to be pushed, the build is marked FAILURE. When `null`, the `npm_packages` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.npm_packages.new](#fn-buildbuildnpm_packagesnew) constructor.\n  - `objects` (`list[obj]`): A list of objects to be uploaded to Cloud Storage upon successful completion of all build steps.\n\nFiles in the workspace matching specified paths globs will be uploaded to the\nCloud Storage location using the builder service account's credentials.\n\nThe location and generation of the uploaded objects will be stored in the Build resource's results field.\n\nIf any objects fail to be pushed, the build is marked FAILURE. When `null`, the `objects` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.objects.new](#fn-buildbuildobjectsnew) constructor.\n  - `python_packages` (`list[obj]`): Python package to upload to Artifact Registry upon successful completion of all build steps. A package can encapsulate multiple objects to be uploaded to a single repository.\n\nThe location and generation of the uploaded objects will be stored in the Build resource's results field.\n\nIf any objects fail to be pushed, the build is marked FAILURE. When `null`, the `python_packages` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.python_packages.new](#fn-buildbuildpython_packagesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `artifacts` sub block.\n', args=[]),
       new(
         images=null,
-        objects=null
+        maven_artifacts=null,
+        npm_packages=null,
+        objects=null,
+        python_packages=null
       ):: std.prune(a={
         images: images,
+        maven_artifacts: maven_artifacts,
+        npm_packages: npm_packages,
         objects: objects,
+        python_packages: python_packages,
       }),
+      npm_packages:: {
+        '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.artifacts.npm_packages.new` constructs a new object with attributes and blocks configured for the `npm_packages`\nTerraform sub block.\n\n\n\n**Args**:\n  - `package_path` (`string`): Path to the package.json. e.g. workspace/path/to/package When `null`, the `package_path` field will be omitted from the resulting object.\n  - `repository` (`string`): Artifact Registry repository, in the form "https://$REGION-npm.pkg.dev/$PROJECT/$REPOSITORY"\n\nNpm package in the workspace specified by path will be zipped and uploaded to Artifact Registry with this location as a prefix. When `null`, the `repository` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `npm_packages` sub block.\n', args=[]),
+        new(
+          package_path=null,
+          repository=null
+        ):: std.prune(a={
+          package_path: package_path,
+          repository: repository,
+        }),
+      },
       objects:: {
         '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.artifacts.objects.new` constructs a new object with attributes and blocks configured for the `objects`\nTerraform sub block.\n\n\n\n**Args**:\n  - `location` (`string`): Cloud Storage bucket and optional object path, in the form "gs://bucket/path/to/somewhere/".\n\nFiles in the workspace matching any path pattern will be uploaded to Cloud Storage with\nthis location as a prefix. When `null`, the `location` field will be omitted from the resulting object.\n  - `paths` (`list`): Path globs used to match files in the build's workspace. When `null`, the `paths` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `objects` sub block.\n', args=[]),
         new(
@@ -70,6 +102,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           paths: paths,
         }),
       },
+      python_packages:: {
+        '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.artifacts.python_packages.new` constructs a new object with attributes and blocks configured for the `python_packages`\nTerraform sub block.\n\n\n\n**Args**:\n  - `paths` (`list`): Path globs used to match files in the build's workspace. For Python/ Twine, this is usually dist/*, and sometimes additionally an .asc file. When `null`, the `paths` field will be omitted from the resulting object.\n  - `repository` (`string`): Artifact Registry repository, in the form "https://$REGION-python.pkg.dev/$PROJECT/$REPOSITORY"\n\nFiles in the workspace matching any path pattern will be uploaded to Artifact Registry with this location as a prefix. When `null`, the `repository` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `python_packages` sub block.\n', args=[]),
+        new(
+          paths=null,
+          repository=null
+        ):: std.prune(a={
+          paths: paths,
+          repository: repository,
+        }),
+      },
     },
     available_secrets:: {
       '#new':: d.fn(help='\n`google.cloudbuild_trigger.build.available_secrets.new` constructs a new object with attributes and blocks configured for the `available_secrets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_manager` (`list[obj]`): Pairs a secret environment variable with a SecretVersion in Secret Manager. When `null`, the `secret_manager` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.available_secrets.secret_manager.new](#fn-buildbuildsecret_managernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `available_secrets` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet b/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet
index 54a51ea8..3020491c 100644
--- a/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet
+++ b/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       peered_network_ip_range: peered_network_ip_range,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudbuild_worker_pool.new` injects a new `google_cloudbuild_worker_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuild_worker_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuild_worker_pool` using the reference:\n\n    $._ref.google_cloudbuild_worker_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuild_worker_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudbuild_worker_pool.new` injects a new `google_cloudbuild_worker_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuild_worker_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuild_worker_pool` using the reference:\n\n    $._ref.google_cloudbuild_worker_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuild_worker_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudbuild_worker_pool.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuild_worker_pool`\nTerraform resource.\n\nUnlike [google.cloudbuild_worker_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuild_worker_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudbuild_worker_pool.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuild_worker_pool`\nTerraform resource.\n\nUnlike [google.cloudbuild_worker_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuild_worker_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloudbuildv2_connection.libsonnet b/4.x/_gen/resources/cloudbuildv2_connection.libsonnet
index 255217d1..d41a523e 100644
--- a/4.x/_gen/resources/cloudbuildv2_connection.libsonnet
+++ b/4.x/_gen/resources/cloudbuildv2_connection.libsonnet
@@ -92,7 +92,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.cloudbuildv2_connection.new` injects a new `google_cloudbuildv2_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_connection` using the reference:\n\n    $._ref.google_cloudbuildv2_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudbuildv2_connection.new` injects a new `google_cloudbuildv2_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_connection` using the reference:\n\n    $._ref.google_cloudbuildv2_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -121,7 +121,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_connection.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_connection`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_connection.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_connection`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloudbuildv2_repository.libsonnet b/4.x/_gen/resources/cloudbuildv2_repository.libsonnet
index 90d5d533..bd7184be 100644
--- a/4.x/_gen/resources/cloudbuildv2_repository.libsonnet
+++ b/4.x/_gen/resources/cloudbuildv2_repository.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='cloudbuildv2_repository', url='', help='`cloudbuildv2_repository` represents the `google_cloudbuildv2_repository` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.cloudbuildv2_repository.new` injects a new `google_cloudbuildv2_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_repository` using the reference:\n\n    $._ref.google_cloudbuildv2_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudbuildv2_repository.new` injects a new `google_cloudbuildv2_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_repository` using the reference:\n\n    $._ref.google_cloudbuildv2_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_repository.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_repository`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_repository` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_repository.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_repository`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_repository` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     parent_connection,
diff --git a/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet b/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet
index 6715aa85..cbc94b86 100644
--- a/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet
+++ b/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='clouddeploy_delivery_pipeline', url='', help='`clouddeploy_delivery_pipeline` represents the `google_clouddeploy_delivery_pipeline` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.clouddeploy_delivery_pipeline.new` injects a new `google_clouddeploy_delivery_pipeline` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_delivery_pipeline.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_delivery_pipeline` using the reference:\n\n    $._ref.google_clouddeploy_delivery_pipeline.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_delivery_pipeline.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.clouddeploy_delivery_pipeline.new` injects a new `google_clouddeploy_delivery_pipeline` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_delivery_pipeline.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_delivery_pipeline` using the reference:\n\n    $._ref.google_clouddeploy_delivery_pipeline.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_delivery_pipeline.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_delivery_pipeline`\nTerraform resource.\n\nUnlike [google.clouddeploy_delivery_pipeline.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_delivery_pipeline` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_delivery_pipeline`\nTerraform resource.\n\nUnlike [google.clouddeploy_delivery_pipeline.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_delivery_pipeline` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -86,14 +86,34 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       strategy:: {
         canary:: {
           canary_deployment:: {
-            '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.new` constructs a new object with attributes and blocks configured for the `canary_deployment`\nTerraform sub block.\n\n\n\n**Args**:\n  - `percentages` (`list`): Required. The percentage based deployments that will occur as a part of a `Rollout`. List is expected in ascending order and each integer n is 0 <= n < 100.\n  - `verify` (`bool`): Whether to run verify tests after each percentage deployment. When `null`, the `verify` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `canary_deployment` sub block.\n', args=[]),
+            '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.new` constructs a new object with attributes and blocks configured for the `canary_deployment`\nTerraform sub block.\n\n\n\n**Args**:\n  - `percentages` (`list`): Required. The percentage based deployments that will occur as a part of a `Rollout`. List is expected in ascending order and each integer n is 0 <= n < 100.\n  - `verify` (`bool`): Whether to run verify tests after each percentage deployment. When `null`, the `verify` field will be omitted from the resulting object.\n  - `postdeploy` (`list[obj]`): Optional. Configuration for the postdeploy job of the last phase. If this is not configured, postdeploy job will not be present. When `null`, the `postdeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarypostdeploynew) constructor.\n  - `predeploy` (`list[obj]`): Optional. Configuration for the predeploy job of the first phase. If this is not configured, predeploy job will not be present. When `null`, the `predeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.predeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarypredeploynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `canary_deployment` sub block.\n', args=[]),
             new(
               percentages,
+              postdeploy=null,
+              predeploy=null,
               verify=null
             ):: std.prune(a={
               percentages: percentages,
+              postdeploy: postdeploy,
+              predeploy: predeploy,
               verify: verify,
             }),
+            postdeploy:: {
+              '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy.new` constructs a new object with attributes and blocks configured for the `postdeploy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the postdeploy job. When `null`, the `actions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `postdeploy` sub block.\n', args=[]),
+              new(
+                actions=null
+              ):: std.prune(a={
+                actions: actions,
+              }),
+            },
+            predeploy:: {
+              '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.predeploy.new` constructs a new object with attributes and blocks configured for the `predeploy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the predeploy job. When `null`, the `actions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predeploy` sub block.\n', args=[]),
+              new(
+                actions=null
+              ):: std.prune(a={
+                actions: actions,
+              }),
+            },
           },
           custom_canary_deployment:: {
             '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.new` constructs a new object with attributes and blocks configured for the `custom_canary_deployment`\nTerraform sub block.\n\n\n\n**Args**:\n  - `phase_configs` (`list[obj]`): Required. Configuration for each phase in the canary deployment in the order executed. When `null`, the `phase_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.new](#fn-serial_pipelineserial_pipelinestagesstrategycanaryphase_configsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_canary_deployment` sub block.\n', args=[]),
@@ -103,18 +123,38 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
               phase_configs: phase_configs,
             }),
             phase_configs:: {
-              '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.new` constructs a new object with attributes and blocks configured for the `phase_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `percentage` (`number`): Required. Percentage deployment for the phase.\n  - `phase_id` (`string`): Required. The ID to assign to the `Rollout` phase. This value must consist of lower-case letters, numbers, and hyphens, start with a letter and end with a letter or a number, and have a max length of 63 characters. In other words, it must match the following regex: `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`.\n  - `profiles` (`list`): Skaffold profiles to use when rendering the manifest for this phase. These are in addition to the profiles list specified in the `DeliveryPipeline` stage. When `null`, the `profiles` field will be omitted from the resulting object.\n  - `verify` (`bool`): Whether to run verify tests after the deployment. When `null`, the `verify` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `phase_configs` sub block.\n', args=[]),
+              '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.new` constructs a new object with attributes and blocks configured for the `phase_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `percentage` (`number`): Required. Percentage deployment for the phase.\n  - `phase_id` (`string`): Required. The ID to assign to the `Rollout` phase. This value must consist of lower-case letters, numbers, and hyphens, start with a letter and end with a letter or a number, and have a max length of 63 characters. In other words, it must match the following regex: `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`.\n  - `profiles` (`list`): Skaffold profiles to use when rendering the manifest for this phase. These are in addition to the profiles list specified in the `DeliveryPipeline` stage. When `null`, the `profiles` field will be omitted from the resulting object.\n  - `verify` (`bool`): Whether to run verify tests after the deployment. When `null`, the `verify` field will be omitted from the resulting object.\n  - `postdeploy` (`list[obj]`): Optional. Configuration for the postdeploy job of this phase. If this is not configured, postdeploy job will not be present for this phase. When `null`, the `postdeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarycustom_canary_deploymentpostdeploynew) constructor.\n  - `predeploy` (`list[obj]`): Optional. Configuration for the predeploy job of this phase. If this is not configured, predeploy job will not be present for this phase. When `null`, the `predeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarycustom_canary_deploymentpredeploynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `phase_configs` sub block.\n', args=[]),
               new(
                 percentage,
                 phase_id,
+                postdeploy=null,
+                predeploy=null,
                 profiles=null,
                 verify=null
               ):: std.prune(a={
                 percentage: percentage,
                 phase_id: phase_id,
+                postdeploy: postdeploy,
+                predeploy: predeploy,
                 profiles: profiles,
                 verify: verify,
               }),
+              postdeploy:: {
+                '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy.new` constructs a new object with attributes and blocks configured for the `postdeploy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the postdeploy job. When `null`, the `actions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `postdeploy` sub block.\n', args=[]),
+                new(
+                  actions=null
+                ):: std.prune(a={
+                  actions: actions,
+                }),
+              },
+              predeploy:: {
+                '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy.new` constructs a new object with attributes and blocks configured for the `predeploy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the predeploy job. When `null`, the `actions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predeploy` sub block.\n', args=[]),
+                new(
+                  actions=null
+                ):: std.prune(a={
+                  actions: actions,
+                }),
+              },
             },
           },
           '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.new` constructs a new object with attributes and blocks configured for the `canary`\nTerraform sub block.\n\n\n\n**Args**:\n  - `canary_deployment` (`list[obj]`): Configures the progressive based deployment for a Target. When `null`, the `canary_deployment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.new](#fn-serial_pipelineserial_pipelinestagesstrategycanary_deploymentnew) constructor.\n  - `custom_canary_deployment` (`list[obj]`): Configures the progressive based deployment for a Target, but allows customizing at the phase level where a phase represents each of the percentage deployments. When `null`, the `custom_canary_deployment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.new](#fn-serial_pipelineserial_pipelinestagesstrategycustom_canary_deploymentnew) constructor.\n  - `runtime_config` (`list[obj]`): Optional. Runtime specific configurations for the deployment strategy. The runtime configuration is used to determine how Cloud Deploy will split traffic to enable a progressive deployment. When `null`, the `runtime_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.runtime_config.new](#fn-serial_pipelineserial_pipelinestagesstrategyruntime_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `canary` sub block.\n', args=[]),
@@ -191,12 +231,32 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           standard: standard,
         }),
         standard:: {
-          '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.new` constructs a new object with attributes and blocks configured for the `standard`\nTerraform sub block.\n\n\n\n**Args**:\n  - `verify` (`bool`): Whether to verify a deployment. When `null`, the `verify` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `standard` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.new` constructs a new object with attributes and blocks configured for the `standard`\nTerraform sub block.\n\n\n\n**Args**:\n  - `verify` (`bool`): Whether to verify a deployment. When `null`, the `verify` field will be omitted from the resulting object.\n  - `postdeploy` (`list[obj]`): Optional. Configuration for the postdeploy job. If this is not configured, postdeploy job will not be present. When `null`, the `postdeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.postdeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategypostdeploynew) constructor.\n  - `predeploy` (`list[obj]`): Optional. Configuration for the predeploy job. If this is not configured, predeploy job will not be present. When `null`, the `predeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.predeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategypredeploynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `standard` sub block.\n', args=[]),
           new(
+            postdeploy=null,
+            predeploy=null,
             verify=null
           ):: std.prune(a={
+            postdeploy: postdeploy,
+            predeploy: predeploy,
             verify: verify,
           }),
+          postdeploy:: {
+            '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.postdeploy.new` constructs a new object with attributes and blocks configured for the `postdeploy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the postdeploy job. When `null`, the `actions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `postdeploy` sub block.\n', args=[]),
+            new(
+              actions=null
+            ):: std.prune(a={
+              actions: actions,
+            }),
+          },
+          predeploy:: {
+            '#new':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.predeploy.new` constructs a new object with attributes and blocks configured for the `predeploy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the predeploy job. When `null`, the `actions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predeploy` sub block.\n', args=[]),
+            new(
+              actions=null
+            ):: std.prune(a={
+              actions: actions,
+            }),
+          },
         },
       },
     },
diff --git a/4.x/_gen/resources/clouddeploy_target.libsonnet b/4.x/_gen/resources/clouddeploy_target.libsonnet
index 3d9364ce..a64a9c9d 100644
--- a/4.x/_gen/resources/clouddeploy_target.libsonnet
+++ b/4.x/_gen/resources/clouddeploy_target.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       target_ids: target_ids,
     }),
   },
-  '#new':: d.fn(help="\n`google.clouddeploy_target.new` injects a new `google_clouddeploy_target` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_target.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_target` using the reference:\n\n    $._ref.google_clouddeploy_target.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_target.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.clouddeploy_target.new` injects a new `google_clouddeploy_target` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_target.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_target` using the reference:\n\n    $._ref.google_clouddeploy_target.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_target.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -83,7 +83,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.clouddeploy_target.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_target`\nTerraform resource.\n\nUnlike [google.clouddeploy_target.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_target` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.clouddeploy_target.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_target`\nTerraform resource.\n\nUnlike [google.clouddeploy_target.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_target` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/clouddomains_registration.libsonnet b/4.x/_gen/resources/clouddomains_registration.libsonnet
new file mode 100644
index 00000000..ac743d05
--- /dev/null
+++ b/4.x/_gen/resources/clouddomains_registration.libsonnet
@@ -0,0 +1,418 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='clouddomains_registration', url='', help='`clouddomains_registration` represents the `google_clouddomains_registration` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  contact_settings:: {
+    admin_contact:: {
+      '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.admin_contact.new` constructs a new object with attributes and blocks configured for the `admin_contact`\nTerraform sub block.\n\n\n\n**Args**:\n  - `email` (`string`): Required. Email address of the contact.\n  - `fax_number` (`string`): Fax number of the contact in international format. For example, "+1-800-555-0123". When `null`, the `fax_number` field will be omitted from the resulting object.\n  - `phone_number` (`string`): Required. Phone number of the contact in international format. For example, "+1-800-555-0123".\n  - `postal_address` (`list[obj]`): Required. Postal address of the contact. When `null`, the `postal_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.admin_contact.postal_address.new](#fn-contact_settingscontact_settingspostal_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `admin_contact` sub block.\n', args=[]),
+      new(
+        email,
+        phone_number,
+        fax_number=null,
+        postal_address=null
+      ):: std.prune(a={
+        email: email,
+        fax_number: fax_number,
+        phone_number: phone_number,
+        postal_address: postal_address,
+      }),
+      postal_address:: {
+        '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.admin_contact.postal_address.new` constructs a new object with attributes and blocks configured for the `postal_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_lines` (`list`): Unstructured address lines describing the lower levels of an address.\nBecause values in addressLines do not have type information and may sometimes contain multiple values in a single\nfield (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be\n"envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language\nis used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way,\nthe most specific line of an address can be selected based on the language. When `null`, the `address_lines` field will be omitted from the resulting object.\n  - `administrative_area` (`string`): Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state,\na province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community\n(e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland\nthis should be left unpopulated. When `null`, the `administrative_area` field will be omitted from the resulting object.\n  - `locality` (`string`): Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world\nwhere localities are not well defined or do not fit into this structure well, leave locality empty and use addressLines. When `null`, the `locality` field will be omitted from the resulting object.\n  - `organization` (`string`): The name of the organization at the address. When `null`, the `organization` field will be omitted from the resulting object.\n  - `postal_code` (`string`): Postal code of the address. Not all countries use or require postal codes to be present, but where they are used,\nthey may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.). When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `recipients` (`list`): The recipient at the address. This field may, under certain circumstances, contain multiline information. For example,\nit might contain "care of" information. When `null`, the `recipients` field will be omitted from the resulting object.\n  - `region_code` (`string`): Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to\nensure the value is correct. See https://cldr.unicode.org/ and\nhttps://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.\n\n**Returns**:\n  - An attribute object that represents the `postal_address` sub block.\n', args=[]),
+        new(
+          region_code,
+          address_lines=null,
+          administrative_area=null,
+          locality=null,
+          organization=null,
+          postal_code=null,
+          recipients=null
+        ):: std.prune(a={
+          address_lines: address_lines,
+          administrative_area: administrative_area,
+          locality: locality,
+          organization: organization,
+          postal_code: postal_code,
+          recipients: recipients,
+          region_code: region_code,
+        }),
+      },
+    },
+    '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.new` constructs a new object with attributes and blocks configured for the `contact_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `privacy` (`string`): Required. Privacy setting for the contacts associated with the Registration.\nValues are PUBLIC_CONTACT_DATA, PRIVATE_CONTACT_DATA, and REDACTED_CONTACT_DATA\n  - `admin_contact` (`list[obj]`): Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.\n\nWarning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to\navoid domain suspension. When `null`, the `admin_contact` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.admin_contact.new](#fn-contact_settingsadmin_contactnew) constructor.\n  - `registrant_contact` (`list[obj]`): Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.\n\nWarning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to\navoid domain suspension. When `null`, the `registrant_contact` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.registrant_contact.new](#fn-contact_settingsregistrant_contactnew) constructor.\n  - `technical_contact` (`list[obj]`): Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.\n\nWarning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to\navoid domain suspension. When `null`, the `technical_contact` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.technical_contact.new](#fn-contact_settingstechnical_contactnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `contact_settings` sub block.\n', args=[]),
+    new(
+      privacy,
+      admin_contact=null,
+      registrant_contact=null,
+      technical_contact=null
+    ):: std.prune(a={
+      admin_contact: admin_contact,
+      privacy: privacy,
+      registrant_contact: registrant_contact,
+      technical_contact: technical_contact,
+    }),
+    registrant_contact:: {
+      '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.registrant_contact.new` constructs a new object with attributes and blocks configured for the `registrant_contact`\nTerraform sub block.\n\n\n\n**Args**:\n  - `email` (`string`): Required. Email address of the contact.\n  - `fax_number` (`string`): Fax number of the contact in international format. For example, "+1-800-555-0123". When `null`, the `fax_number` field will be omitted from the resulting object.\n  - `phone_number` (`string`): Required. Phone number of the contact in international format. For example, "+1-800-555-0123".\n  - `postal_address` (`list[obj]`): Required. Postal address of the contact. When `null`, the `postal_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.registrant_contact.postal_address.new](#fn-contact_settingscontact_settingspostal_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `registrant_contact` sub block.\n', args=[]),
+      new(
+        email,
+        phone_number,
+        fax_number=null,
+        postal_address=null
+      ):: std.prune(a={
+        email: email,
+        fax_number: fax_number,
+        phone_number: phone_number,
+        postal_address: postal_address,
+      }),
+      postal_address:: {
+        '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.registrant_contact.postal_address.new` constructs a new object with attributes and blocks configured for the `postal_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_lines` (`list`): Unstructured address lines describing the lower levels of an address.\nBecause values in addressLines do not have type information and may sometimes contain multiple values in a single\nfield (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be\n"envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language\nis used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way,\nthe most specific line of an address can be selected based on the language. When `null`, the `address_lines` field will be omitted from the resulting object.\n  - `administrative_area` (`string`): Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state,\na province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community\n(e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland\nthis should be left unpopulated. When `null`, the `administrative_area` field will be omitted from the resulting object.\n  - `locality` (`string`): Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world\nwhere localities are not well defined or do not fit into this structure well, leave locality empty and use addressLines. When `null`, the `locality` field will be omitted from the resulting object.\n  - `organization` (`string`): The name of the organization at the address. When `null`, the `organization` field will be omitted from the resulting object.\n  - `postal_code` (`string`): Postal code of the address. Not all countries use or require postal codes to be present, but where they are used,\nthey may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.). When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `recipients` (`list`): The recipient at the address. This field may, under certain circumstances, contain multiline information. For example,\nit might contain "care of" information. When `null`, the `recipients` field will be omitted from the resulting object.\n  - `region_code` (`string`): Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to\nensure the value is correct. See https://cldr.unicode.org/ and\nhttps://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.\n\n**Returns**:\n  - An attribute object that represents the `postal_address` sub block.\n', args=[]),
+        new(
+          region_code,
+          address_lines=null,
+          administrative_area=null,
+          locality=null,
+          organization=null,
+          postal_code=null,
+          recipients=null
+        ):: std.prune(a={
+          address_lines: address_lines,
+          administrative_area: administrative_area,
+          locality: locality,
+          organization: organization,
+          postal_code: postal_code,
+          recipients: recipients,
+          region_code: region_code,
+        }),
+      },
+    },
+    technical_contact:: {
+      '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.technical_contact.new` constructs a new object with attributes and blocks configured for the `technical_contact`\nTerraform sub block.\n\n\n\n**Args**:\n  - `email` (`string`): Required. Email address of the contact.\n  - `fax_number` (`string`): Fax number of the contact in international format. For example, "+1-800-555-0123". When `null`, the `fax_number` field will be omitted from the resulting object.\n  - `phone_number` (`string`): Required. Phone number of the contact in international format. For example, "+1-800-555-0123".\n  - `postal_address` (`list[obj]`): Required. Postal address of the contact. When `null`, the `postal_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.technical_contact.postal_address.new](#fn-contact_settingscontact_settingspostal_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `technical_contact` sub block.\n', args=[]),
+      new(
+        email,
+        phone_number,
+        fax_number=null,
+        postal_address=null
+      ):: std.prune(a={
+        email: email,
+        fax_number: fax_number,
+        phone_number: phone_number,
+        postal_address: postal_address,
+      }),
+      postal_address:: {
+        '#new':: d.fn(help='\n`google.clouddomains_registration.contact_settings.technical_contact.postal_address.new` constructs a new object with attributes and blocks configured for the `postal_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_lines` (`list`): Unstructured address lines describing the lower levels of an address.\nBecause values in addressLines do not have type information and may sometimes contain multiple values in a single\nfield (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be\n"envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language\nis used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way,\nthe most specific line of an address can be selected based on the language. When `null`, the `address_lines` field will be omitted from the resulting object.\n  - `administrative_area` (`string`): Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state,\na province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community\n(e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland\nthis should be left unpopulated. When `null`, the `administrative_area` field will be omitted from the resulting object.\n  - `locality` (`string`): Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world\nwhere localities are not well defined or do not fit into this structure well, leave locality empty and use addressLines. When `null`, the `locality` field will be omitted from the resulting object.\n  - `organization` (`string`): The name of the organization at the address. When `null`, the `organization` field will be omitted from the resulting object.\n  - `postal_code` (`string`): Postal code of the address. Not all countries use or require postal codes to be present, but where they are used,\nthey may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.). When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `recipients` (`list`): The recipient at the address. This field may, under certain circumstances, contain multiline information. For example,\nit might contain "care of" information. When `null`, the `recipients` field will be omitted from the resulting object.\n  - `region_code` (`string`): Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to\nensure the value is correct. See https://cldr.unicode.org/ and\nhttps://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.\n\n**Returns**:\n  - An attribute object that represents the `postal_address` sub block.\n', args=[]),
+        new(
+          region_code,
+          address_lines=null,
+          administrative_area=null,
+          locality=null,
+          organization=null,
+          postal_code=null,
+          recipients=null
+        ):: std.prune(a={
+          address_lines: address_lines,
+          administrative_area: administrative_area,
+          locality: locality,
+          organization: organization,
+          postal_code: postal_code,
+          recipients: recipients,
+          region_code: region_code,
+        }),
+      },
+    },
+  },
+  dns_settings:: {
+    custom_dns:: {
+      ds_records:: {
+        '#new':: d.fn(help='\n`google.clouddomains_registration.dns_settings.custom_dns.ds_records.new` constructs a new object with attributes and blocks configured for the `ds_records`\nTerraform sub block.\n\n\n\n**Args**:\n  - `algorithm` (`string`): The algorithm used to generate the referenced DNSKEY. When `null`, the `algorithm` field will be omitted from the resulting object.\n  - `digest` (`string`): The digest generated from the referenced DNSKEY. When `null`, the `digest` field will be omitted from the resulting object.\n  - `digest_type` (`string`): The hash function used to generate the digest of the referenced DNSKEY. When `null`, the `digest_type` field will be omitted from the resulting object.\n  - `key_tag` (`number`): The key tag of the record. Must be set in range 0 -- 65535. When `null`, the `key_tag` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ds_records` sub block.\n', args=[]),
+        new(
+          algorithm=null,
+          digest=null,
+          digest_type=null,
+          key_tag=null
+        ):: std.prune(a={
+          algorithm: algorithm,
+          digest: digest,
+          digest_type: digest_type,
+          key_tag: key_tag,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.clouddomains_registration.dns_settings.custom_dns.new` constructs a new object with attributes and blocks configured for the `custom_dns`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name_servers` (`list`): Required. A list of name servers that store the DNS zone for this domain. Each name server is a domain\nname, with Unicode domain names expressed in Punycode format.\n  - `ds_records` (`list[obj]`): The list of DS records for this domain, which are used to enable DNSSEC. The domain's DNS provider can provide\nthe values to set here. If this field is empty, DNSSEC is disabled. When `null`, the `ds_records` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.custom_dns.ds_records.new](#fn-dns_settingsdns_settingsds_recordsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_dns` sub block.\n', args=[]),
+      new(
+        name_servers,
+        ds_records=null
+      ):: std.prune(a={
+        ds_records: ds_records,
+        name_servers: name_servers,
+      }),
+    },
+    glue_records:: {
+      '#new':: d.fn(help='\n`google.clouddomains_registration.dns_settings.glue_records.new` constructs a new object with attributes and blocks configured for the `glue_records`\nTerraform sub block.\n\n\n\n**Args**:\n  - `host_name` (`string`): Required. Domain name of the host in Punycode format.\n  - `ipv4_addresses` (`list`): List of IPv4 addresses corresponding to this host in the standard decimal format (e.g. 198.51.100.1).\nAt least one of ipv4_address and ipv6_address must be set. When `null`, the `ipv4_addresses` field will be omitted from the resulting object.\n  - `ipv6_addresses` (`list`): List of IPv4 addresses corresponding to this host in the standard decimal format (e.g. 198.51.100.1).\nAt least one of ipv4_address and ipv6_address must be set. When `null`, the `ipv6_addresses` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `glue_records` sub block.\n', args=[]),
+      new(
+        host_name,
+        ipv4_addresses=null,
+        ipv6_addresses=null
+      ):: std.prune(a={
+        host_name: host_name,
+        ipv4_addresses: ipv4_addresses,
+        ipv6_addresses: ipv6_addresses,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.clouddomains_registration.dns_settings.new` constructs a new object with attributes and blocks configured for the `dns_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `custom_dns` (`list[obj]`): Configuration for an arbitrary DNS provider. When `null`, the `custom_dns` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.custom_dns.new](#fn-dns_settingscustom_dnsnew) constructor.\n  - `glue_records` (`list[obj]`): The list of glue records for this Registration. Commonly empty. When `null`, the `glue_records` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.glue_records.new](#fn-dns_settingsglue_recordsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `dns_settings` sub block.\n', args=[]),
+    new(
+      custom_dns=null,
+      glue_records=null
+    ):: std.prune(a={
+      custom_dns: custom_dns,
+      glue_records: glue_records,
+    }),
+  },
+  management_settings:: {
+    '#new':: d.fn(help='\n`google.clouddomains_registration.management_settings.new` constructs a new object with attributes and blocks configured for the `management_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `preferred_renewal_method` (`string`): The desired renewal method for this Registration. The actual renewalMethod is automatically updated to reflect this choice.\nIf unset or equal to RENEWAL_METHOD_UNSPECIFIED, the actual renewalMethod is treated as if it were set to AUTOMATIC_RENEWAL.\nYou cannot use RENEWAL_DISABLED during resource creation, and you can update the renewal status only when the Registration\nresource has state ACTIVE or SUSPENDED.\n\nWhen preferredRenewalMethod is set to AUTOMATIC_RENEWAL, the actual renewalMethod can be set to RENEWAL_DISABLED in case of\nproblems with the billing account or reported domain abuse. In such cases, check the issues field on the Registration. After\nthe problem is resolved, the renewalMethod is automatically updated to preferredRenewalMethod in a few hours. When `null`, the `preferred_renewal_method` field will be omitted from the resulting object.\n  - `transfer_lock_state` (`string`): Controls whether the domain can be transferred to another registrar. Values are UNLOCKED or LOCKED. When `null`, the `transfer_lock_state` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management_settings` sub block.\n', args=[]),
+    new(
+      preferred_renewal_method=null,
+      transfer_lock_state=null
+    ):: std.prune(a={
+      preferred_renewal_method: preferred_renewal_method,
+      transfer_lock_state: transfer_lock_state,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.clouddomains_registration.new` injects a new `google_clouddomains_registration` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddomains_registration.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddomains_registration` using the reference:\n\n    $._ref.google_clouddomains_registration.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddomains_registration.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `contact_notices` (`list`): The list of contact notices that the caller acknowledges. Possible value is PUBLIC_CONTACT_DATA_ACKNOWLEDGEMENT When `null`, the `contact_notices` field will be omitted from the resulting object.\n  - `domain_name` (`string`): Required. The domain name. Unicode domain names must be expressed in Punycode format.\n  - `domain_notices` (`list`): The list of domain notices that you acknowledge. Possible value is HSTS_PRELOADED When `null`, the `domain_notices` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with the Registration.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `contact_settings` (`list[obj]`): Required. Settings for contact information linked to the Registration. When `null`, the `contact_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.new](#fn-contact_settingsnew) constructor.\n  - `dns_settings` (`list[obj]`): Settings controlling the DNS configuration of the Registration. When `null`, the `dns_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.new](#fn-dns_settingsnew) constructor.\n  - `management_settings` (`list[obj]`): Settings for management of the Registration, including renewal, billing, and transfer When `null`, the `management_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.management_settings.new](#fn-management_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.timeouts.new](#fn-timeoutsnew) constructor.\n  - `yearly_price` (`list[obj]`): Required. Yearly price to register or renew the domain. The value that should be put here can be obtained from\nregistrations.retrieveRegisterParameters or registrations.searchDomains calls. When `null`, the `yearly_price` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.yearly_price.new](#fn-yearly_pricenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    domain_name,
+    location,
+    contact_notices=null,
+    contact_settings=null,
+    dns_settings=null,
+    domain_notices=null,
+    labels=null,
+    management_settings=null,
+    project=null,
+    timeouts=null,
+    yearly_price=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_clouddomains_registration',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      contact_notices=contact_notices,
+      contact_settings=contact_settings,
+      dns_settings=dns_settings,
+      domain_name=domain_name,
+      domain_notices=domain_notices,
+      labels=labels,
+      location=location,
+      management_settings=management_settings,
+      project=project,
+      timeouts=timeouts,
+      yearly_price=yearly_price
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.clouddomains_registration.newAttrs` constructs a new object with attributes and blocks configured for the `clouddomains_registration`\nTerraform resource.\n\nUnlike [google.clouddomains_registration.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `contact_notices` (`list`): The list of contact notices that the caller acknowledges. Possible value is PUBLIC_CONTACT_DATA_ACKNOWLEDGEMENT When `null`, the `contact_notices` field will be omitted from the resulting object.\n  - `domain_name` (`string`): Required. The domain name. Unicode domain names must be expressed in Punycode format.\n  - `domain_notices` (`list`): The list of domain notices that you acknowledge. Possible value is HSTS_PRELOADED When `null`, the `domain_notices` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with the Registration.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `contact_settings` (`list[obj]`): Required. Settings for contact information linked to the Registration. When `null`, the `contact_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.new](#fn-contact_settingsnew) constructor.\n  - `dns_settings` (`list[obj]`): Settings controlling the DNS configuration of the Registration. When `null`, the `dns_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.new](#fn-dns_settingsnew) constructor.\n  - `management_settings` (`list[obj]`): Settings for management of the Registration, including renewal, billing, and transfer When `null`, the `management_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.management_settings.new](#fn-management_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.timeouts.new](#fn-timeoutsnew) constructor.\n  - `yearly_price` (`list[obj]`): Required. Yearly price to register or renew the domain. The value that should be put here can be obtained from\nregistrations.retrieveRegisterParameters or registrations.searchDomains calls. When `null`, the `yearly_price` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.yearly_price.new](#fn-yearly_pricenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddomains_registration` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    domain_name,
+    location,
+    contact_notices=null,
+    contact_settings=null,
+    dns_settings=null,
+    domain_notices=null,
+    labels=null,
+    management_settings=null,
+    project=null,
+    timeouts=null,
+    yearly_price=null
+  ):: std.prune(a={
+    contact_notices: contact_notices,
+    contact_settings: contact_settings,
+    dns_settings: dns_settings,
+    domain_name: domain_name,
+    domain_notices: domain_notices,
+    labels: labels,
+    location: location,
+    management_settings: management_settings,
+    project: project,
+    timeouts: timeouts,
+    yearly_price: yearly_price,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.clouddomains_registration.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withContactNotices':: d.fn(help='`google.list.withContactNotices` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the contact_notices field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `contact_notices` field.\n', args=[]),
+  withContactNotices(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          contact_notices: value,
+        },
+      },
+    },
+  },
+  '#withContactSettings':: d.fn(help='`google.list[obj].withContactSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the contact_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withContactSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `contact_settings` field.\n', args=[]),
+  withContactSettings(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          contact_settings: value,
+        },
+      },
+    },
+  },
+  '#withContactSettingsMixin':: d.fn(help='`google.list[obj].withContactSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the contact_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withContactSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `contact_settings` field.\n', args=[]),
+  withContactSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          contact_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDnsSettings':: d.fn(help='`google.list[obj].withDnsSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dns_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDnsSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dns_settings` field.\n', args=[]),
+  withDnsSettings(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          dns_settings: value,
+        },
+      },
+    },
+  },
+  '#withDnsSettingsMixin':: d.fn(help='`google.list[obj].withDnsSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dns_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDnsSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dns_settings` field.\n', args=[]),
+  withDnsSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          dns_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDomainName':: d.fn(help='`google.string.withDomainName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the domain_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `domain_name` field.\n', args=[]),
+  withDomainName(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          domain_name: value,
+        },
+      },
+    },
+  },
+  '#withDomainNotices':: d.fn(help='`google.list.withDomainNotices` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the domain_notices field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `domain_notices` field.\n', args=[]),
+  withDomainNotices(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          domain_notices: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withManagementSettings':: d.fn(help='`google.list[obj].withManagementSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the management_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withManagementSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `management_settings` field.\n', args=[]),
+  withManagementSettings(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          management_settings: value,
+        },
+      },
+    },
+  },
+  '#withManagementSettingsMixin':: d.fn(help='`google.list[obj].withManagementSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the management_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withManagementSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `management_settings` field.\n', args=[]),
+  withManagementSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          management_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withYearlyPrice':: d.fn(help='`google.list[obj].withYearlyPrice` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the yearly_price field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withYearlyPriceMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `yearly_price` field.\n', args=[]),
+  withYearlyPrice(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          yearly_price: value,
+        },
+      },
+    },
+  },
+  '#withYearlyPriceMixin':: d.fn(help='`google.list[obj].withYearlyPriceMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the yearly_price field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withYearlyPrice](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `yearly_price` field.\n', args=[]),
+  withYearlyPriceMixin(resourceLabel, value): {
+    resource+: {
+      google_clouddomains_registration+: {
+        [resourceLabel]+: {
+          yearly_price+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  yearly_price:: {
+    '#new':: d.fn(help='\n`google.clouddomains_registration.yearly_price.new` constructs a new object with attributes and blocks configured for the `yearly_price`\nTerraform sub block.\n\n\n\n**Args**:\n  - `currency_code` (`string`): The three-letter currency code defined in ISO 4217. When `null`, the `currency_code` field will be omitted from the resulting object.\n  - `units` (`string`): The whole units of the amount. For example if currencyCode is "USD", then 1 unit is one US dollar. When `null`, the `units` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `yearly_price` sub block.\n', args=[]),
+    new(
+      currency_code=null,
+      units=null
+    ):: std.prune(a={
+      currency_code: currency_code,
+      units: units,
+    }),
+  },
+}
diff --git a/4.x/_gen/resources/cloudfunctions2_function.libsonnet b/4.x/_gen/resources/cloudfunctions2_function.libsonnet
index 51eb75f4..22dd4c73 100644
--- a/4.x/_gen/resources/cloudfunctions2_function.libsonnet
+++ b/4.x/_gen/resources/cloudfunctions2_function.libsonnet
@@ -75,7 +75,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         value: value,
       }),
     },
-    '#new':: d.fn(help='\n`google.cloudfunctions2_function.event_trigger.new` constructs a new object with attributes and blocks configured for the `event_trigger`\nTerraform sub block.\n\n\n\n**Args**:\n  - `event_type` (`string`): Required. The type of event to observe. When `null`, the `event_type` field will be omitted from the resulting object.\n  - `pubsub_topic` (`string`): The name of a Pub/Sub topic in the same project that will be used\nas the transport topic for the event delivery. When `null`, the `pubsub_topic` field will be omitted from the resulting object.\n  - `retry_policy` (`string`): Describes the retry policy in case of function's execution failure.\nRetried execution is charged as any other execution. Possible values: ["RETRY_POLICY_UNSPECIFIED", "RETRY_POLICY_DO_NOT_RETRY", "RETRY_POLICY_RETRY"] When `null`, the `retry_policy` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The email of the service account for this function. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `trigger_region` (`string`): The region that the trigger will be in. The trigger will only receive\nevents originating in this region. It can be the same\nregion as the function, a different region or multi-region, or the global\nregion. If not provided, defaults to the same region as the function. When `null`, the `trigger_region` field will be omitted from the resulting object.\n  - `event_filters` (`list[obj]`): Criteria used to filter events. When `null`, the `event_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.event_filters.new](#fn-event_triggerevent_filtersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `event_trigger` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.cloudfunctions2_function.event_trigger.new` constructs a new object with attributes and blocks configured for the `event_trigger`\nTerraform sub block.\n\n\n\n**Args**:\n  - `event_type` (`string`): Required. The type of event to observe. When `null`, the `event_type` field will be omitted from the resulting object.\n  - `pubsub_topic` (`string`): The name of a Pub/Sub topic in the same project that will be used\nas the transport topic for the event delivery. When `null`, the `pubsub_topic` field will be omitted from the resulting object.\n  - `retry_policy` (`string`): Describes the retry policy in case of function's execution failure.\nRetried execution is charged as any other execution. Possible values: ["RETRY_POLICY_UNSPECIFIED", "RETRY_POLICY_DO_NOT_RETRY", "RETRY_POLICY_RETRY"] When `null`, the `retry_policy` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): Optional. The email of the trigger's service account. The service account\nmust have permission to invoke Cloud Run services. If empty, defaults to the\nCompute Engine default service account: {project_number}-compute@developer.gserviceaccount.com. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `trigger_region` (`string`): The region that the trigger will be in. The trigger will only receive\nevents originating in this region. It can be the same\nregion as the function, a different region or multi-region, or the global\nregion. If not provided, defaults to the same region as the function. When `null`, the `trigger_region` field will be omitted from the resulting object.\n  - `event_filters` (`list[obj]`): Criteria used to filter events. When `null`, the `event_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.event_filters.new](#fn-event_triggerevent_filtersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `event_trigger` sub block.\n', args=[]),
     new(
       event_filters=null,
       event_type=null,
@@ -92,16 +92,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       trigger_region: trigger_region,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudfunctions2_function.new` injects a new `google_cloudfunctions2_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions2_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions2_function` using the reference:\n\n    $._ref.google_cloudfunctions2_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions2_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern \u0026#39;projects/*/locations/*/functions/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudfunctions2_function.new` injects a new `google_cloudfunctions2_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions2_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions2_function` using the reference:\n\n    $._ref.google_cloudfunctions2_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions2_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern \u0026#39;projects/*/locations/*/functions/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    location,
     name,
     build_config=null,
     description=null,
     event_trigger=null,
     kms_key_name=null,
     labels=null,
-    location=null,
     project=null,
     service_config=null,
     timeouts=null,
@@ -123,15 +123,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudfunctions2_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions2_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions2_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern 'projects/*/locations/*/functions/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions2_function` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudfunctions2_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions2_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions2_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern 'projects/*/locations/*/functions/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions2_function` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    location,
     name,
     build_config=null,
     description=null,
     event_trigger=null,
     kms_key_name=null,
     labels=null,
-    location=null,
     project=null,
     service_config=null,
     timeouts=null
diff --git a/4.x/_gen/resources/cloudfunctions_function.libsonnet b/4.x/_gen/resources/cloudfunctions_function.libsonnet
index 7bfe2f3b..91aa9e29 100644
--- a/4.x/_gen/resources/cloudfunctions_function.libsonnet
+++ b/4.x/_gen/resources/cloudfunctions_function.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       resource: resource,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudfunctions_function.new` injects a new `google_cloudfunctions_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions_function` using the reference:\n\n    $._ref.google_cloudfunctions_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function\u0026#39;s Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. \u0026#34;nodejs12\u0026#34;, \u0026#34;nodejs14\u0026#34;, \u0026#34;python37\u0026#34;, \u0026#34;go111\u0026#34;.\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudfunctions_function.new` injects a new `google_cloudfunctions_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions_function` using the reference:\n\n    $._ref.google_cloudfunctions_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function\u0026#39;s Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. \u0026#34;nodejs12\u0026#34;, \u0026#34;nodejs14\u0026#34;, \u0026#34;python37\u0026#34;, \u0026#34;go111\u0026#34;.\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -95,7 +95,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudfunctions_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function's Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. "nodejs12", "nodejs14", "python37", "go111".\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions_function` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudfunctions_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function's Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. "nodejs12", "nodejs14", "python37", "go111".\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions_function` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     runtime,
diff --git a/4.x/_gen/resources/cloudiot_device.libsonnet b/4.x/_gen/resources/cloudiot_device.libsonnet
deleted file mode 100644
index dbd34ca3..00000000
--- a/4.x/_gen/resources/cloudiot_device.libsonnet
+++ /dev/null
@@ -1,204 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_device', url='', help='`cloudiot_device` represents the `google_cloudiot_device` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  credentials:: {
-    '#new':: d.fn(help='\n`google.cloudiot_device.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `expiration_time` (`string`): The time at which this credential becomes invalid. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): A public key used to verify the signature of JSON Web Tokens (JWTs). When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.public_key.new](#fn-credentialspublic_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `credentials` sub block.\n', args=[]),
-    new(
-      expiration_time=null,
-      public_key=null
-    ):: std.prune(a={
-      expiration_time: expiration_time,
-      public_key: public_key,
-    }),
-    public_key:: {
-      '#new':: d.fn(help='\n`google.cloudiot_device.credentials.public_key.new` constructs a new object with attributes and blocks configured for the `public_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `format` (`string`): The format of the key. Possible values: ["RSA_PEM", "RSA_X509_PEM", "ES256_PEM", "ES256_X509_PEM"]\n  - `key` (`string`): The key data.\n\n**Returns**:\n  - An attribute object that represents the `public_key` sub block.\n', args=[]),
-      new(
-        format,
-        key
-      ):: std.prune(a={
-        format: format,
-        key: key,
-      }),
-    },
-  },
-  gateway_config:: {
-    '#new':: d.fn(help='\n`google.cloudiot_device.gateway_config.new` constructs a new object with attributes and blocks configured for the `gateway_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gateway_auth_method` (`string`): Indicates whether the device is a gateway. Possible values: ["ASSOCIATION_ONLY", "DEVICE_AUTH_TOKEN_ONLY", "ASSOCIATION_AND_DEVICE_AUTH_TOKEN"] When `null`, the `gateway_auth_method` field will be omitted from the resulting object.\n  - `gateway_type` (`string`): Indicates whether the device is a gateway. Default value: "NON_GATEWAY" Possible values: ["GATEWAY", "NON_GATEWAY"] When `null`, the `gateway_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `gateway_config` sub block.\n', args=[]),
-    new(
-      gateway_auth_method=null,
-      gateway_type=null
-    ):: std.prune(a={
-      gateway_auth_method: gateway_auth_method,
-      gateway_type: gateway_type,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_device.new` injects a new `google_cloudiot_device` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_device.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_device` using the reference:\n\n    $._ref.google_cloudiot_device.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_device.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.\n  - `log_level` (`string`): The logging verbosity for device activity. Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ERROR\u0026#34;, \u0026#34;INFO\u0026#34;, \u0026#34;DEBUG\u0026#34;] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource.\n  - `registry` (`string`): The name of the device registry where this device should be created.\n  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.\n  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    name,
-    registry,
-    blocked=null,
-    credentials=null,
-    gateway_config=null,
-    log_level=null,
-    metadata=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_device',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      blocked=blocked,
-      credentials=credentials,
-      gateway_config=gateway_config,
-      log_level=log_level,
-      metadata=metadata,
-      name=name,
-      registry=registry,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_device.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_device`\nTerraform resource.\n\nUnlike [google.cloudiot_device.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.\n  - `log_level` (`string`): The logging verbosity for device activity. Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource.\n  - `registry` (`string`): The name of the device registry where this device should be created.\n  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.\n  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_device` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    registry,
-    blocked=null,
-    credentials=null,
-    gateway_config=null,
-    log_level=null,
-    metadata=null,
-    timeouts=null
-  ):: std.prune(a={
-    blocked: blocked,
-    credentials: credentials,
-    gateway_config: gateway_config,
-    log_level: log_level,
-    metadata: metadata,
-    name: name,
-    registry: registry,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.cloudiot_device.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withBlocked':: d.fn(help='`google.bool.withBlocked` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the blocked field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `blocked` field.\n', args=[]),
-  withBlocked(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          blocked: value,
-        },
-      },
-    },
-  },
-  '#withCredentials':: d.fn(help='`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentials(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          credentials: value,
-        },
-      },
-    },
-  },
-  '#withCredentialsMixin':: d.fn(help='`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentialsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          credentials+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withGatewayConfig':: d.fn(help='`google.list[obj].withGatewayConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gateway_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGatewayConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gateway_config` field.\n', args=[]),
-  withGatewayConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          gateway_config: value,
-        },
-      },
-    },
-  },
-  '#withGatewayConfigMixin':: d.fn(help='`google.list[obj].withGatewayConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gateway_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGatewayConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gateway_config` field.\n', args=[]),
-  withGatewayConfigMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          gateway_config+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withLogLevel':: d.fn(help='`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the log_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `log_level` field.\n', args=[]),
-  withLogLevel(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          log_level: value,
-        },
-      },
-    },
-  },
-  '#withMetadata':: d.fn(help='`google.obj.withMetadata` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the metadata field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `metadata` field.\n', args=[]),
-  withMetadata(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          metadata: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withRegistry':: d.fn(help='`google.string.withRegistry` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the registry field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `registry` field.\n', args=[]),
-  withRegistry(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          registry: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry.libsonnet b/4.x/_gen/resources/cloudiot_registry.libsonnet
deleted file mode 100644
index 07348148..00000000
--- a/4.x/_gen/resources/cloudiot_registry.libsonnet
+++ /dev/null
@@ -1,220 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry', url='', help='`cloudiot_registry` represents the `google_cloudiot_registry` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  credentials:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_key_certificate` (`obj`): A public key certificate format and data.\n\n**Returns**:\n  - An attribute object that represents the `credentials` sub block.\n', args=[]),
-    new(
-      public_key_certificate
-    ):: std.prune(a={
-      public_key_certificate: public_key_certificate,
-    }),
-  },
-  event_notification_configs:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry.event_notification_configs.new` constructs a new object with attributes and blocks configured for the `event_notification_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pubsub_topic_name` (`string`): PubSub topic name to publish device events.\n  - `subfolder_matches` (`string`): If the subfolder name matches this string exactly, this\nconfiguration will be used. The string must not include the\nleading '/' character. If empty, all strings are matched. Empty\nvalue can only be used for the last 'event_notification_configs'\nitem. When `null`, the `subfolder_matches` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `event_notification_configs` sub block.\n', args=[]),
-    new(
-      pubsub_topic_name,
-      subfolder_matches=null
-    ):: std.prune(a={
-      pubsub_topic_name: pubsub_topic_name,
-      subfolder_matches: subfolder_matches,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_registry.new` injects a new `google_cloudiot_registry` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry` using the reference:\n\n    $._ref.google_cloudiot_registry.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.\n  - `log_level` (`string`): The default logging verbosity for activity from devices in this\nregistry. Specifies which events should be written to logs. For\nexample, if the LogLevel is ERROR, only events that terminate in\nerrors will be logged. LogLevel is inclusive; enabling INFO logging\nwill also enable ERROR logging. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ERROR\u0026#34;, \u0026#34;INFO\u0026#34;, \u0026#34;DEBUG\u0026#34;] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by device registry.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created registry should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.\n  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.\n  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics\nto publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    name,
-    credentials=null,
-    event_notification_configs=null,
-    http_config=null,
-    log_level=null,
-    mqtt_config=null,
-    project=null,
-    region=null,
-    state_notification_config=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      credentials=credentials,
-      event_notification_configs=event_notification_configs,
-      http_config=http_config,
-      log_level=log_level,
-      mqtt_config=mqtt_config,
-      name=name,
-      project=project,
-      region=region,
-      state_notification_config=state_notification_config,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry`\nTerraform resource.\n\nUnlike [google.cloudiot_registry.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.\n  - `log_level` (`string`): The default logging verbosity for activity from devices in this\nregistry. Specifies which events should be written to logs. For\nexample, if the LogLevel is ERROR, only events that terminate in\nerrors will be logged. LogLevel is inclusive; enabling INFO logging\nwill also enable ERROR logging. Default value: "NONE" Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by device registry.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created registry should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.\n  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.\n  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics\nto publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    credentials=null,
-    event_notification_configs=null,
-    http_config=null,
-    log_level=null,
-    mqtt_config=null,
-    project=null,
-    region=null,
-    state_notification_config=null,
-    timeouts=null
-  ):: std.prune(a={
-    credentials: credentials,
-    event_notification_configs: event_notification_configs,
-    http_config: http_config,
-    log_level: log_level,
-    mqtt_config: mqtt_config,
-    name: name,
-    project: project,
-    region: region,
-    state_notification_config: state_notification_config,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withCredentials':: d.fn(help='`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentials(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          credentials: value,
-        },
-      },
-    },
-  },
-  '#withCredentialsMixin':: d.fn(help='`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentialsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          credentials+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withEventNotificationConfigs':: d.fn(help='`google.list[obj].withEventNotificationConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_notification_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEventNotificationConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.\n', args=[]),
-  withEventNotificationConfigs(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          event_notification_configs: value,
-        },
-      },
-    },
-  },
-  '#withEventNotificationConfigsMixin':: d.fn(help='`google.list[obj].withEventNotificationConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_notification_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEventNotificationConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.\n', args=[]),
-  withEventNotificationConfigsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          event_notification_configs+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withHttpConfig':: d.fn(help='`google.obj.withHttpConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the http_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `http_config` field.\n', args=[]),
-  withHttpConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          http_config: value,
-        },
-      },
-    },
-  },
-  '#withLogLevel':: d.fn(help='`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the log_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `log_level` field.\n', args=[]),
-  withLogLevel(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          log_level: value,
-        },
-      },
-    },
-  },
-  '#withMqttConfig':: d.fn(help='`google.obj.withMqttConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the mqtt_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `mqtt_config` field.\n', args=[]),
-  withMqttConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          mqtt_config: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-  '#withStateNotificationConfig':: d.fn(help='`google.obj.withStateNotificationConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the state_notification_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `state_notification_config` field.\n', args=[]),
-  withStateNotificationConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          state_notification_config: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry_iam_member.libsonnet b/4.x/_gen/resources/cloudiot_registry_iam_member.libsonnet
deleted file mode 100644
index 18b302ec..00000000
--- a/4.x/_gen/resources/cloudiot_registry_iam_member.libsonnet
+++ /dev/null
@@ -1,126 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_member', url='', help='`cloudiot_registry_iam_member` represents the `google_cloudiot_registry_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  condition:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
-    new(
-      expression,
-      title,
-      description=null
-    ):: std.prune(a={
-      description: description,
-      expression: expression,
-      title: title,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_registry_iam_member.new` injects a new `google_cloudiot_registry_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry_iam_member` using the reference:\n\n    $._ref.google_cloudiot_registry_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    member,
-    name,
-    role,
-    condition=null,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry_iam_member',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      condition=condition,
-      member=member,
-      name=name,
-      project=project,
-      region=region,
-      role=role
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_member`\nTerraform resource.\n\nUnlike [google.cloudiot_registry_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_member` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    member,
-    name,
-    role,
-    condition=null,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    condition: condition,
-    member: member,
-    name: name,
-    project: project,
-    region: region,
-    role: role,
-  }),
-  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
-  withCondition(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          condition: value,
-        },
-      },
-    },
-  },
-  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
-  withConditionMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          condition+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
-  withMember(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          member: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
-  withRole(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          role: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry_iam_policy.libsonnet b/4.x/_gen/resources/cloudiot_registry_iam_policy.libsonnet
deleted file mode 100644
index 6b09ebae..00000000
--- a/4.x/_gen/resources/cloudiot_registry_iam_policy.libsonnet
+++ /dev/null
@@ -1,76 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_policy', url='', help='`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.cloudiot_registry_iam_policy.new` injects a new `google_cloudiot_registry_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry_iam_policy` using the reference:\n\n    $._ref.google_cloudiot_registry_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    name,
-    policy_data,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry_iam_policy',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      name=name,
-      policy_data=policy_data,
-      project=project,
-      region=region
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`\nTerraform resource.\n\nUnlike [google.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_policy` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    policy_data,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    name: name,
-    policy_data: policy_data,
-    project: project,
-    region: region,
-  }),
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
-  withPolicyData(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          policy_data: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/composer_environment.libsonnet b/4.x/_gen/resources/composer_environment.libsonnet
index 3903cd6a..2fa4cfec 100644
--- a/4.x/_gen/resources/composer_environment.libsonnet
+++ b/4.x/_gen/resources/composer_environment.libsonnet
@@ -3,12 +3,30 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='composer_environment', url='', help='`composer_environment` represents the `google_composer_environment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   config:: {
+    data_retention_config:: {
+      '#new':: d.fn(help='\n`google.composer_environment.config.data_retention_config.new` constructs a new object with attributes and blocks configured for the `data_retention_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `task_logs_retention_config` (`list[obj]`): Optional. The configuration setting for Task Logs. When `null`, the `task_logs_retention_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.data_retention_config.task_logs_retention_config.new](#fn-configconfigtask_logs_retention_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `data_retention_config` sub block.\n', args=[]),
+      new(
+        task_logs_retention_config=null
+      ):: std.prune(a={
+        task_logs_retention_config: task_logs_retention_config,
+      }),
+      task_logs_retention_config:: {
+        '#new':: d.fn(help='\n`google.composer_environment.config.data_retention_config.task_logs_retention_config.new` constructs a new object with attributes and blocks configured for the `task_logs_retention_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `storage_mode` (`string`): Whether logs in cloud logging only is enabled or not. This field is supported for Cloud Composer environments in versions composer-2.0.32-airflow-2.1.4 and newer. When `null`, the `storage_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `task_logs_retention_config` sub block.\n', args=[]),
+        new(
+          storage_mode=null
+        ):: std.prune(a={
+          storage_mode: storage_mode,
+        }),
+      },
+    },
     database_config:: {
-      '#new':: d.fn(help='\n`google.composer_environment.config.database_config.new` constructs a new object with attributes and blocks configured for the `database_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_type` (`string`): Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.\n\n**Returns**:\n  - An attribute object that represents the `database_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.composer_environment.config.database_config.new` constructs a new object with attributes and blocks configured for the `database_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_type` (`string`): Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `zone` (`string`): Optional. Cloud SQL database preferred zone. When `null`, the `zone` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `database_config` sub block.\n', args=[]),
       new(
-        machine_type
+        machine_type=null,
+        zone=null
       ):: std.prune(a={
         machine_type: machine_type,
+        zone: zone,
       }),
     },
     encryption_config:: {
@@ -51,8 +69,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         enabled: enabled,
       }),
     },
-    '#new':: d.fn(help='\n`google.composer_environment.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `environment_size` (`string`): The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. When `null`, the `environment_size` field will be omitted from the resulting object.\n  - `node_count` (`number`): The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `node_count` field will be omitted from the resulting object.\n  - `resilience_mode` (`string`): Whether high resilience is enabled or not. This field is supported for Cloud Composer environments in versions composer-2.1.15-airflow-*.*.* and newer. When `null`, the `resilience_mode` field will be omitted from the resulting object.\n  - `database_config` (`list[obj]`): The configuration of Cloud SQL instance that is used by the Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `database_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.database_config.new](#fn-configdatabase_confignew) constructor.\n  - `encryption_config` (`list[obj]`): The encryption options for the Composer environment and its dependencies. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.encryption_config.new](#fn-configencryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The configuration for Cloud Composer maintenance window. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.maintenance_window.new](#fn-configmaintenance_windownew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs. When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.master_authorized_networks_config.new](#fn-configmaster_authorized_networks_confignew) constructor.\n  - `node_config` (`list[obj]`): The configuration used for the Kubernetes Engine cluster. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.node_config.new](#fn-confignode_confignew) constructor.\n  - `private_environment_config` (`list[obj]`): The configuration used for the Private IP Cloud Composer environment. When `null`, the `private_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.private_environment_config.new](#fn-configprivate_environment_confignew) constructor.\n  - `recovery_config` (`list[obj]`): The recovery configuration settings for the Cloud Composer environment When `null`, the `recovery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.recovery_config.new](#fn-configrecovery_confignew) constructor.\n  - `software_config` (`list[obj]`): The configuration settings for software inside the environment. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.software_config.new](#fn-configsoftware_confignew) constructor.\n  - `web_server_config` (`list[obj]`): The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `web_server_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_config.new](#fn-configweb_server_confignew) constructor.\n  - `web_server_network_access_control` (`list[obj]`): The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `web_server_network_access_control` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_network_access_control.new](#fn-configweb_server_network_access_controlnew) constructor.\n  - `workloads_config` (`list[obj]`): The workloads configuration settings for the GKE cluster associated with the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. When `null`, the `workloads_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.new](#fn-configworkloads_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.composer_environment.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `environment_size` (`string`): The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. When `null`, the `environment_size` field will be omitted from the resulting object.\n  - `node_count` (`number`): The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `node_count` field will be omitted from the resulting object.\n  - `resilience_mode` (`string`): Whether high resilience is enabled or not. This field is supported for Cloud Composer environments in versions composer-2.1.15-airflow-*.*.* and newer. When `null`, the `resilience_mode` field will be omitted from the resulting object.\n  - `data_retention_config` (`list[obj]`): The configuration setting for Airflow data retention mechanism. This field is supported for Cloud Composer environments in versions composer-2.0.32-airflow-2.1.4. or newer When `null`, the `data_retention_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.data_retention_config.new](#fn-configdata_retention_confignew) constructor.\n  - `database_config` (`list[obj]`): The configuration of Cloud SQL instance that is used by the Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `database_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.database_config.new](#fn-configdatabase_confignew) constructor.\n  - `encryption_config` (`list[obj]`): The encryption options for the Composer environment and its dependencies. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.encryption_config.new](#fn-configencryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The configuration for Cloud Composer maintenance window. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.maintenance_window.new](#fn-configmaintenance_windownew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs. When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.master_authorized_networks_config.new](#fn-configmaster_authorized_networks_confignew) constructor.\n  - `node_config` (`list[obj]`): The configuration used for the Kubernetes Engine cluster. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.node_config.new](#fn-confignode_confignew) constructor.\n  - `private_environment_config` (`list[obj]`): The configuration used for the Private IP Cloud Composer environment. When `null`, the `private_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.private_environment_config.new](#fn-configprivate_environment_confignew) constructor.\n  - `recovery_config` (`list[obj]`): The recovery configuration settings for the Cloud Composer environment When `null`, the `recovery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.recovery_config.new](#fn-configrecovery_confignew) constructor.\n  - `software_config` (`list[obj]`): The configuration settings for software inside the environment. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.software_config.new](#fn-configsoftware_confignew) constructor.\n  - `web_server_config` (`list[obj]`): The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `web_server_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_config.new](#fn-configweb_server_confignew) constructor.\n  - `web_server_network_access_control` (`list[obj]`): Network-level access control policy for the Airflow web server. When `null`, the `web_server_network_access_control` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_network_access_control.new](#fn-configweb_server_network_access_controlnew) constructor.\n  - `workloads_config` (`list[obj]`): The workloads configuration settings for the GKE cluster associated with the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. When `null`, the `workloads_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.new](#fn-configworkloads_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
     new(
+      data_retention_config=null,
       database_config=null,
       encryption_config=null,
       environment_size=null,
@@ -68,6 +87,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       web_server_network_access_control=null,
       workloads_config=null
     ):: std.prune(a={
+      data_retention_config: data_retention_config,
       database_config: database_config,
       encryption_config: encryption_config,
       environment_size: environment_size,
@@ -198,13 +218,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     workloads_config:: {
-      '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.new` constructs a new object with attributes and blocks configured for the `workloads_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `scheduler` (`list[obj]`): Configuration for resources used by Airflow schedulers. When `null`, the `scheduler` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.scheduler.new](#fn-configconfigschedulernew) constructor.\n  - `web_server` (`list[obj]`): Configuration for resources used by Airflow web server. When `null`, the `web_server` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.web_server.new](#fn-configconfigweb_servernew) constructor.\n  - `worker` (`list[obj]`): Configuration for resources used by Airflow workers. When `null`, the `worker` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.worker.new](#fn-configconfigworkernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `workloads_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.new` constructs a new object with attributes and blocks configured for the `workloads_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `scheduler` (`list[obj]`): Configuration for resources used by Airflow schedulers. When `null`, the `scheduler` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.scheduler.new](#fn-configconfigschedulernew) constructor.\n  - `triggerer` (`list[obj]`): Configuration for resources used by Airflow triggerers. When `null`, the `triggerer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.triggerer.new](#fn-configconfigtriggerernew) constructor.\n  - `web_server` (`list[obj]`): Configuration for resources used by Airflow web server. When `null`, the `web_server` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.web_server.new](#fn-configconfigweb_servernew) constructor.\n  - `worker` (`list[obj]`): Configuration for resources used by Airflow workers. When `null`, the `worker` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.worker.new](#fn-configconfigworkernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `workloads_config` sub block.\n', args=[]),
       new(
         scheduler=null,
+        triggerer=null,
         web_server=null,
         worker=null
       ):: std.prune(a={
         scheduler: scheduler,
+        triggerer: triggerer,
         web_server: web_server,
         worker: worker,
       }),
@@ -222,6 +244,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           storage_gb: storage_gb,
         }),
       },
+      triggerer:: {
+        '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.triggerer.new` constructs a new object with attributes and blocks configured for the `triggerer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `count` (`number`): The number of triggerers.\n  - `cpu` (`number`): CPU request and limit for a single Airflow triggerer replica.\n  - `memory_gb` (`number`): Memory (GB) request and limit for a single Airflow triggerer replica.\n\n**Returns**:\n  - An attribute object that represents the `triggerer` sub block.\n', args=[]),
+        new(
+          count,
+          cpu,
+          memory_gb
+        ):: std.prune(a={
+          count: count,
+          cpu: cpu,
+          memory_gb: memory_gb,
+        }),
+      },
       web_server:: {
         '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.web_server.new` constructs a new object with attributes and blocks configured for the `web_server`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu` (`number`): CPU request and limit for Airflow web server. When `null`, the `cpu` field will be omitted from the resulting object.\n  - `memory_gb` (`number`): Memory (GB) request and limit for Airflow web server. When `null`, the `memory_gb` field will be omitted from the resulting object.\n  - `storage_gb` (`number`): Storage (GB) request and limit for Airflow web server. When `null`, the `storage_gb` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `web_server` sub block.\n', args=[]),
         new(
@@ -252,7 +286,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.composer_environment.new` injects a new `google_composer_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.composer_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.composer_environment` using the reference:\n\n    $._ref.google_composer_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_composer_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be \u0026lt;= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.composer_environment.new` injects a new `google_composer_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.composer_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.composer_environment` using the reference:\n\n    $._ref.google_composer_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_composer_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be \u0026lt;= 128 bytes in size.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `storage_config` (`list[obj]`): Configuration options for storage used by Composer environment. When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.storage_config.new](#fn-storage_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -260,6 +294,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     project=null,
     region=null,
+    storage_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -271,17 +306,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name=name,
       project=project,
       region=region,
+      storage_config=storage_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.composer_environment.newAttrs` constructs a new object with attributes and blocks configured for the `composer_environment`\nTerraform resource.\n\nUnlike [google.composer_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `composer_environment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.composer_environment.newAttrs` constructs a new object with attributes and blocks configured for the `composer_environment`\nTerraform resource.\n\nUnlike [google.composer_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `storage_config` (`list[obj]`): Configuration options for storage used by Composer environment. When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.storage_config.new](#fn-storage_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `composer_environment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     config=null,
     labels=null,
     project=null,
     region=null,
+    storage_config=null,
     timeouts=null
   ):: std.prune(a={
     config: config,
@@ -289,8 +326,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name: name,
     project: project,
     region: region,
+    storage_config: storage_config,
     timeouts: timeouts,
   }),
+  storage_config:: {
+    '#new':: d.fn(help='\n`google.composer_environment.storage_config.new` constructs a new object with attributes and blocks configured for the `storage_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bucket` (`string`): Optional. Name of an existing Cloud Storage bucket to be used by the environment.\n\n**Returns**:\n  - An attribute object that represents the `storage_config` sub block.\n', args=[]),
+    new(
+      bucket
+    ):: std.prune(a={
+      bucket: bucket,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.composer_environment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -363,6 +409,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStorageConfig':: d.fn(help='`google.list[obj].withStorageConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage_config` field.\n', args=[]),
+  withStorageConfig(resourceLabel, value): {
+    resource+: {
+      google_composer_environment+: {
+        [resourceLabel]+: {
+          storage_config: value,
+        },
+      },
+    },
+  },
+  '#withStorageConfigMixin':: d.fn(help='`google.list[obj].withStorageConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorageConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage_config` field.\n', args=[]),
+  withStorageConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_composer_environment+: {
+        [resourceLabel]+: {
+          storage_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_address.libsonnet b/4.x/_gen/resources/compute_address.libsonnet
index c9968423..f6b1be5d 100644
--- a/4.x/_gen/resources/compute_address.libsonnet
+++ b/4.x/_gen/resources/compute_address.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_address', url='', help='`compute_address` represents the `google_compute_address` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_address.new` injects a new `google_compute_address` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_address.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_address` using the reference:\n\n    $._ref.google_compute_address.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_address.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument\u0026#39;s value as \u0026#39;INTERNAL\u0026#39; you need to leave the \u0026#39;network_tier\u0026#39; argument unset in that resource block. Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;INTERNAL\u0026#34;, \u0026#34;EXTERNAL\u0026#34;] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is \u0026#39;IPV4\u0026#39;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: [\u0026#34;VM\u0026#34;, \u0026#34;NETLB\u0026#34;] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it\u0026#39;s always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork\u0026#39;s IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_address.new` injects a new `google_compute_address` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_address.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_address` using the reference:\n\n    $._ref.google_compute_address.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_address.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument\u0026#39;s value as \u0026#39;INTERNAL\u0026#39; you need to leave the \u0026#39;network_tier\u0026#39; argument unset in that resource block. Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;INTERNAL\u0026#34;, \u0026#34;EXTERNAL\u0026#34;] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is \u0026#39;IPV4\u0026#39;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: [\u0026#34;VM\u0026#34;, \u0026#34;NETLB\u0026#34;] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this address.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it\u0026#39;s always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork\u0026#39;s IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -11,6 +11,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description=null,
     ip_version=null,
     ipv6_endpoint_type=null,
+    labels=null,
     network=null,
     network_tier=null,
     prefix_length=null,
@@ -29,6 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       description=description,
       ip_version=ip_version,
       ipv6_endpoint_type=ipv6_endpoint_type,
+      labels=labels,
       name=name,
       network=network,
       network_tier=network_tier,
@@ -41,7 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_address.newAttrs` constructs a new object with attributes and blocks configured for the `compute_address`\nTerraform resource.\n\nUnlike [google.compute_address.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument's value as 'INTERNAL' you need to leave the 'network_tier' argument unset in that resource block. Default value: "EXTERNAL" Possible values: ["INTERNAL", "EXTERNAL"] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is 'IPV4'. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it's always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork's IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_address` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_address.newAttrs` constructs a new object with attributes and blocks configured for the `compute_address`\nTerraform resource.\n\nUnlike [google.compute_address.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument's value as 'INTERNAL' you need to leave the 'network_tier' argument unset in that resource block. Default value: "EXTERNAL" Possible values: ["INTERNAL", "EXTERNAL"] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is 'IPV4'. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this address.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it's always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork's IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_address` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     address=null,
@@ -49,6 +51,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description=null,
     ip_version=null,
     ipv6_endpoint_type=null,
+    labels=null,
     network=null,
     network_tier=null,
     prefix_length=null,
@@ -63,6 +66,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description: description,
     ip_version: ip_version,
     ipv6_endpoint_type: ipv6_endpoint_type,
+    labels: labels,
     name: name,
     network: network,
     network_tier: network_tier,
@@ -74,13 +78,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.compute_address.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_address.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withAddress':: d.fn(help='`google.string.withAddress` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the address field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `address` field.\n', args=[]),
@@ -133,6 +139,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_compute_address+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
   '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
   withName(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_backend_service.libsonnet b/4.x/_gen/resources/compute_backend_service.libsonnet
index 87975d99..357a0d9a 100644
--- a/4.x/_gen/resources/compute_backend_service.libsonnet
+++ b/4.x/_gen/resources/compute_backend_service.libsonnet
@@ -192,7 +192,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       sample_rate: sample_rate,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_backend_service.new` injects a new `google_compute_backend_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_backend_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_backend_service` using the reference:\n\n    $._ref.google_compute_backend_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_backend_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `affinity_cookie_ttl_sec` (`number`): Lifetime of cookies in seconds if session_affinity is\nGENERATED_COOKIE. If set to 0, the cookie is non-persistent and lasts\nonly until the end of the browser session (or equivalent). The\nmaximum allowed value for TTL is one day.\n\nWhen the load balancing scheme is INTERNAL, this field is not used. When `null`, the `affinity_cookie_ttl_sec` field will be omitted from the resulting object.\n  - `compression_mode` (`string`): Compress text responses using Brotli or gzip compression, based on the client\u0026#39;s Accept-Encoding header. Possible values: [\u0026#34;AUTOMATIC\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `compression_mode` field will be omitted from the resulting object.\n  - `connection_draining_timeout_sec` (`number`): Time for which instance will be drained (not accept new\nconnections, but still work to finish started). When `null`, the `connection_draining_timeout_sec` field will be omitted from the resulting object.\n  - `custom_request_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nrequests. When `null`, the `custom_request_headers` field will be omitted from the resulting object.\n  - `custom_response_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nresponses. When `null`, the `custom_response_headers` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): The resource URL for the edge security policy associated with this backend service. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `enable_cdn` (`bool`): If true, enable Cloud CDN for this BackendService. When `null`, the `enable_cdn` field will be omitted from the resulting object.\n  - `health_checks` (`list`): The set of URLs to the HttpHealthCheck or HttpsHealthCheck resource\nfor health checking this BackendService. Currently at most one health\ncheck can be specified.\n\nA health check must be specified unless the backend service uses an internet\nor serverless NEG as a backend.\n\nFor internal load balancing, a URL to a HealthCheck resource must be specified instead. When `null`, the `health_checks` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Indicates whether the backend service will be used with internal or\nexternal load balancing. A backend service created for one type of\nload balancing cannot be used with the other. For more information, refer to\n[Choosing a load balancer](https://cloud.google.com/load-balancing/docs/backend-service). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;INTERNAL_SELF_MANAGED\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `locality_lb_policy` (`string`): The load balancing algorithm used within the scope of the locality.\nThe possible values are:\n\n* \u0026#39;ROUND_ROBIN\u0026#39;: This is a simple policy in which each healthy backend\n                 is selected in round robin order.\n\n* \u0026#39;LEAST_REQUEST\u0026#39;: An O(1) algorithm which selects two random healthy\n                   hosts and picks the host which has fewer active requests.\n\n* \u0026#39;RING_HASH\u0026#39;: The ring/modulo hash load balancer implements consistent\n               hashing to backends. The algorithm has the property that the\n               addition/removal of a host from a set of N hosts only affects\n               1/N of the requests.\n\n* \u0026#39;RANDOM\u0026#39;: The load balancer selects a random healthy host.\n\n* \u0026#39;ORIGINAL_DESTINATION\u0026#39;: Backend host is selected based on the client\n                          connection metadata, i.e., connections are opened\n                          to the same address as the destination address of\n                          the incoming connection before the connection\n                          was redirected to the load balancer.\n\n* \u0026#39;MAGLEV\u0026#39;: used as a drop in replacement for the ring hash load balancer.\n            Maglev is not as stable as ring hash but has faster table lookup\n            build times and host selection times. For more information about\n            Maglev, refer to https://ai.google/research/pubs/pub44824\n\n* \u0026#39;WEIGHTED_MAGLEV\u0026#39;: Per-instance weighted Load Balancing via health check\n                     reported weights. If set, the Backend Service must\n                     configure a non legacy HTTP-based Health Check, and\n                     health check replies are expected to contain\n                     non-standard HTTP response header field\n                     X-Load-Balancing-Endpoint-Weight to specify the\n                     per-instance weights. If set, Load Balancing is weight\n                     based on the per-instance weights reported in the last\n                     processed health check replies, as long as every\n                     instance either reported a valid weight or had\n                     UNAVAILABLE_WEIGHT. Otherwise, Load Balancing remains\n                     equal-weight.\n\n\nThis field is applicable to either:\n\n* A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2,\n  and loadBalancingScheme set to INTERNAL_MANAGED.\n* A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED.\n* A regional backend service with loadBalancingScheme set to EXTERNAL (External Network\n  Load Balancing). Only MAGLEV and WEIGHTED_MAGLEV values are possible for External\n  Network Load Balancing. The default is MAGLEV.\n\n\nIf session_affinity is not NONE, and this field is not set to MAGLEV, WEIGHTED_MAGLEV,\nor RING_HASH, session affinity settings will not take effect.\n\nOnly ROUND_ROBIN and RING_HASH are supported when the backend service is referenced\nby a URL map that is bound to target gRPC proxy that has validate_for_proxyless\nfield set to true. Possible values: [\u0026#34;ROUND_ROBIN\u0026#34;, \u0026#34;LEAST_REQUEST\u0026#34;, \u0026#34;RING_HASH\u0026#34;, \u0026#34;RANDOM\u0026#34;, \u0026#34;ORIGINAL_DESTINATION\u0026#34;, \u0026#34;MAGLEV\u0026#34;, \u0026#34;WEIGHTED_MAGLEV\u0026#34;] When `null`, the `locality_lb_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `port_name` (`string`): Name of backend port. The same name should appear in the instance\ngroups referenced by this service. Required when the load balancing\nscheme is EXTERNAL. When `null`, the `port_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol this BackendService uses to communicate with backends.\nThe default is HTTP. **NOTE**: HTTP2 is only valid for beta HTTP/2 load balancer\ntypes and may result in errors if used with the GA API. **NOTE**: With protocol “UNSPECIFIED”,\nthe backend service can be used by Layer 4 Internal Load Balancing or Network Load Balancing\nwith TCP/UDP/L3_DEFAULT Forwarding Rule protocol. Possible values: [\u0026#34;HTTP\u0026#34;, \u0026#34;HTTPS\u0026#34;, \u0026#34;HTTP2\u0026#34;, \u0026#34;TCP\u0026#34;, \u0026#34;SSL\u0026#34;, \u0026#34;GRPC\u0026#34;, \u0026#34;UNSPECIFIED\u0026#34;] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `security_policy` (`string`): The security policy associated with this backend service. When `null`, the `security_policy` field will be omitted from the resulting object.\n  - `session_affinity` (`string`): Type of session affinity to use. The default is NONE. Session affinity is\nnot applicable if the protocol is UDP. Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;CLIENT_IP\u0026#34;, \u0026#34;CLIENT_IP_PORT_PROTO\u0026#34;, \u0026#34;CLIENT_IP_PROTO\u0026#34;, \u0026#34;GENERATED_COOKIE\u0026#34;, \u0026#34;HEADER_FIELD\u0026#34;, \u0026#34;HTTP_COOKIE\u0026#34;] When `null`, the `session_affinity` field will be omitted from the resulting object.\n  - `timeout_sec` (`number`): How many seconds to wait for the backend before considering it a\nfailed request. Default is 30 seconds. Valid range is [1, 86400]. When `null`, the `timeout_sec` field will be omitted from the resulting object.\n  - `backend` (`list[obj]`): The set of backends that serve this BackendService. When `null`, the `backend` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.backend.new](#fn-backendnew) constructor.\n  - `cdn_policy` (`list[obj]`): Cloud CDN configuration for this BackendService. When `null`, the `cdn_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.cdn_policy.new](#fn-cdn_policynew) constructor.\n  - `circuit_breakers` (`list[obj]`): Settings controlling the volume of connections to a backend service. This field\nis applicable only when the load_balancing_scheme is set to INTERNAL_SELF_MANAGED. When `null`, the `circuit_breakers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.circuit_breakers.new](#fn-circuit_breakersnew) constructor.\n  - `consistent_hash` (`list[obj]`): Consistent Hash-based load balancing can be used to provide soft session\naffinity based on HTTP headers, cookies or other properties. This load balancing\npolicy is applicable only for HTTP connections. The affinity to a particular\ndestination host will be lost when one or more hosts are added/removed from the\ndestination service. This field specifies parameters that control consistent\nhashing. This field only applies if the load_balancing_scheme is set to\nINTERNAL_SELF_MANAGED. This field is only applicable when locality_lb_policy is\nset to MAGLEV or RING_HASH. When `null`, the `consistent_hash` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.consistent_hash.new](#fn-consistent_hashnew) constructor.\n  - `iap` (`list[obj]`): Settings for enabling Cloud Identity Aware Proxy When `null`, the `iap` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.iap.new](#fn-iapnew) constructor.\n  - `locality_lb_policies` (`list[obj]`): A list of locality load balancing policies to be used in order of\npreference. Either the policy or the customPolicy field should be set.\nOverrides any value set in the localityLbPolicy field.\n\nlocalityLbPolicies is only supported when the BackendService is referenced\nby a URL Map that is referenced by a target gRPC proxy that has the\nvalidateForProxyless field set to true. When `null`, the `locality_lb_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.locality_lb_policies.new](#fn-locality_lb_policiesnew) constructor.\n  - `log_config` (`list[obj]`): This field denotes the logging options for the load balancer traffic served by this backend service.\nIf logging is enabled, logs will be exported to Stackdriver. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.log_config.new](#fn-log_confignew) constructor.\n  - `outlier_detection` (`list[obj]`): Settings controlling eviction of unhealthy hosts from the load balancing pool.\nThis field is applicable only when the load_balancing_scheme is set\nto INTERNAL_SELF_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.\n  - `security_settings` (`list[obj]`): The security settings that apply to this backend service. This field is applicable to either\na regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and\nload_balancing_scheme set to INTERNAL_MANAGED; or a global backend service with the\nload_balancing_scheme set to INTERNAL_SELF_MANAGED. When `null`, the `security_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.security_settings.new](#fn-security_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_backend_service.new` injects a new `google_compute_backend_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_backend_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_backend_service` using the reference:\n\n    $._ref.google_compute_backend_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_backend_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `affinity_cookie_ttl_sec` (`number`): Lifetime of cookies in seconds if session_affinity is\nGENERATED_COOKIE. If set to 0, the cookie is non-persistent and lasts\nonly until the end of the browser session (or equivalent). The\nmaximum allowed value for TTL is one day.\n\nWhen the load balancing scheme is INTERNAL, this field is not used. When `null`, the `affinity_cookie_ttl_sec` field will be omitted from the resulting object.\n  - `compression_mode` (`string`): Compress text responses using Brotli or gzip compression, based on the client\u0026#39;s Accept-Encoding header. Possible values: [\u0026#34;AUTOMATIC\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `compression_mode` field will be omitted from the resulting object.\n  - `connection_draining_timeout_sec` (`number`): Time for which instance will be drained (not accept new\nconnections, but still work to finish started). When `null`, the `connection_draining_timeout_sec` field will be omitted from the resulting object.\n  - `custom_request_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nrequests. When `null`, the `custom_request_headers` field will be omitted from the resulting object.\n  - `custom_response_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nresponses. When `null`, the `custom_response_headers` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): The resource URL for the edge security policy associated with this backend service. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `enable_cdn` (`bool`): If true, enable Cloud CDN for this BackendService. When `null`, the `enable_cdn` field will be omitted from the resulting object.\n  - `health_checks` (`list`): The set of URLs to the HttpHealthCheck or HttpsHealthCheck resource\nfor health checking this BackendService. Currently at most one health\ncheck can be specified.\n\nA health check must be specified unless the backend service uses an internet\nor serverless NEG as a backend.\n\nFor internal load balancing, a URL to a HealthCheck resource must be specified instead. When `null`, the `health_checks` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Indicates whether the backend service will be used with internal or\nexternal load balancing. A backend service created for one type of\nload balancing cannot be used with the other. For more information, refer to\n[Choosing a load balancer](https://cloud.google.com/load-balancing/docs/backend-service). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;INTERNAL_SELF_MANAGED\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `locality_lb_policy` (`string`): The load balancing algorithm used within the scope of the locality.\nThe possible values are:\n\n* \u0026#39;ROUND_ROBIN\u0026#39;: This is a simple policy in which each healthy backend\n                 is selected in round robin order.\n\n* \u0026#39;LEAST_REQUEST\u0026#39;: An O(1) algorithm which selects two random healthy\n                   hosts and picks the host which has fewer active requests.\n\n* \u0026#39;RING_HASH\u0026#39;: The ring/modulo hash load balancer implements consistent\n               hashing to backends. The algorithm has the property that the\n               addition/removal of a host from a set of N hosts only affects\n               1/N of the requests.\n\n* \u0026#39;RANDOM\u0026#39;: The load balancer selects a random healthy host.\n\n* \u0026#39;ORIGINAL_DESTINATION\u0026#39;: Backend host is selected based on the client\n                          connection metadata, i.e., connections are opened\n                          to the same address as the destination address of\n                          the incoming connection before the connection\n                          was redirected to the load balancer.\n\n* \u0026#39;MAGLEV\u0026#39;: used as a drop in replacement for the ring hash load balancer.\n            Maglev is not as stable as ring hash but has faster table lookup\n            build times and host selection times. For more information about\n            Maglev, refer to https://ai.google/research/pubs/pub44824\n\n* \u0026#39;WEIGHTED_MAGLEV\u0026#39;: Per-instance weighted Load Balancing via health check\n                     reported weights. If set, the Backend Service must\n                     configure a non legacy HTTP-based Health Check, and\n                     health check replies are expected to contain\n                     non-standard HTTP response header field\n                     X-Load-Balancing-Endpoint-Weight to specify the\n                     per-instance weights. If set, Load Balancing is weight\n                     based on the per-instance weights reported in the last\n                     processed health check replies, as long as every\n                     instance either reported a valid weight or had\n                     UNAVAILABLE_WEIGHT. Otherwise, Load Balancing remains\n                     equal-weight.\n\n\nThis field is applicable to either:\n\n* A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2,\n  and loadBalancingScheme set to INTERNAL_MANAGED.\n* A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED.\n* A regional backend service with loadBalancingScheme set to EXTERNAL (External Network\n  Load Balancing). Only MAGLEV and WEIGHTED_MAGLEV values are possible for External\n  Network Load Balancing. The default is MAGLEV.\n\n\nIf session_affinity is not NONE, and this field is not set to MAGLEV, WEIGHTED_MAGLEV,\nor RING_HASH, session affinity settings will not take effect.\n\nOnly ROUND_ROBIN and RING_HASH are supported when the backend service is referenced\nby a URL map that is bound to target gRPC proxy that has validate_for_proxyless\nfield set to true. Possible values: [\u0026#34;ROUND_ROBIN\u0026#34;, \u0026#34;LEAST_REQUEST\u0026#34;, \u0026#34;RING_HASH\u0026#34;, \u0026#34;RANDOM\u0026#34;, \u0026#34;ORIGINAL_DESTINATION\u0026#34;, \u0026#34;MAGLEV\u0026#34;, \u0026#34;WEIGHTED_MAGLEV\u0026#34;] When `null`, the `locality_lb_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `port_name` (`string`): Name of backend port. The same name should appear in the instance\ngroups referenced by this service. Required when the load balancing\nscheme is EXTERNAL. When `null`, the `port_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol this BackendService uses to communicate with backends.\nThe default is HTTP. **NOTE**: HTTP2 is only valid for beta HTTP/2 load balancer\ntypes and may result in errors if used with the GA API. **NOTE**: With protocol “UNSPECIFIED”,\nthe backend service can be used by Layer 4 Internal Load Balancing or Network Load Balancing\nwith TCP/UDP/L3_DEFAULT Forwarding Rule protocol. Possible values: [\u0026#34;HTTP\u0026#34;, \u0026#34;HTTPS\u0026#34;, \u0026#34;HTTP2\u0026#34;, \u0026#34;TCP\u0026#34;, \u0026#34;SSL\u0026#34;, \u0026#34;GRPC\u0026#34;, \u0026#34;UNSPECIFIED\u0026#34;] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `security_policy` (`string`): The security policy associated with this backend service. When `null`, the `security_policy` field will be omitted from the resulting object.\n  - `session_affinity` (`string`): Type of session affinity to use. The default is NONE. Session affinity is\nnot applicable if the protocol is UDP. Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;CLIENT_IP\u0026#34;, \u0026#34;CLIENT_IP_PORT_PROTO\u0026#34;, \u0026#34;CLIENT_IP_PROTO\u0026#34;, \u0026#34;GENERATED_COOKIE\u0026#34;, \u0026#34;HEADER_FIELD\u0026#34;, \u0026#34;HTTP_COOKIE\u0026#34;] When `null`, the `session_affinity` field will be omitted from the resulting object.\n  - `timeout_sec` (`number`): How many seconds to wait for the backend before considering it a\nfailed request. Default is 30 seconds. Valid range is [1, 86400]. When `null`, the `timeout_sec` field will be omitted from the resulting object.\n  - `backend` (`list[obj]`): The set of backends that serve this BackendService. When `null`, the `backend` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.backend.new](#fn-backendnew) constructor.\n  - `cdn_policy` (`list[obj]`): Cloud CDN configuration for this BackendService. When `null`, the `cdn_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.cdn_policy.new](#fn-cdn_policynew) constructor.\n  - `circuit_breakers` (`list[obj]`): Settings controlling the volume of connections to a backend service. This field\nis applicable only when the load_balancing_scheme is set to INTERNAL_SELF_MANAGED. When `null`, the `circuit_breakers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.circuit_breakers.new](#fn-circuit_breakersnew) constructor.\n  - `consistent_hash` (`list[obj]`): Consistent Hash-based load balancing can be used to provide soft session\naffinity based on HTTP headers, cookies or other properties. This load balancing\npolicy is applicable only for HTTP connections. The affinity to a particular\ndestination host will be lost when one or more hosts are added/removed from the\ndestination service. This field specifies parameters that control consistent\nhashing. This field only applies if the load_balancing_scheme is set to\nINTERNAL_SELF_MANAGED. This field is only applicable when locality_lb_policy is\nset to MAGLEV or RING_HASH. When `null`, the `consistent_hash` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.consistent_hash.new](#fn-consistent_hashnew) constructor.\n  - `iap` (`list[obj]`): Settings for enabling Cloud Identity Aware Proxy When `null`, the `iap` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.iap.new](#fn-iapnew) constructor.\n  - `locality_lb_policies` (`list[obj]`): A list of locality load balancing policies to be used in order of\npreference. Either the policy or the customPolicy field should be set.\nOverrides any value set in the localityLbPolicy field.\n\nlocalityLbPolicies is only supported when the BackendService is referenced\nby a URL Map that is referenced by a target gRPC proxy that has the\nvalidateForProxyless field set to true. When `null`, the `locality_lb_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.locality_lb_policies.new](#fn-locality_lb_policiesnew) constructor.\n  - `log_config` (`list[obj]`): This field denotes the logging options for the load balancer traffic served by this backend service.\nIf logging is enabled, logs will be exported to Stackdriver. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.log_config.new](#fn-log_confignew) constructor.\n  - `outlier_detection` (`list[obj]`): Settings controlling eviction of unhealthy hosts from the load balancing pool.\nApplicable backend service types can be a global backend service with the\nloadBalancingScheme set to INTERNAL_SELF_MANAGED or EXTERNAL_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.\n  - `security_settings` (`list[obj]`): The security settings that apply to this backend service. This field is applicable to either\na regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and\nload_balancing_scheme set to INTERNAL_MANAGED; or a global backend service with the\nload_balancing_scheme set to INTERNAL_SELF_MANAGED. When `null`, the `security_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.security_settings.new](#fn-security_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -259,7 +259,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_backend_service.newAttrs` constructs a new object with attributes and blocks configured for the `compute_backend_service`\nTerraform resource.\n\nUnlike [google.compute_backend_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `affinity_cookie_ttl_sec` (`number`): Lifetime of cookies in seconds if session_affinity is\nGENERATED_COOKIE. If set to 0, the cookie is non-persistent and lasts\nonly until the end of the browser session (or equivalent). The\nmaximum allowed value for TTL is one day.\n\nWhen the load balancing scheme is INTERNAL, this field is not used. When `null`, the `affinity_cookie_ttl_sec` field will be omitted from the resulting object.\n  - `compression_mode` (`string`): Compress text responses using Brotli or gzip compression, based on the client's Accept-Encoding header. Possible values: ["AUTOMATIC", "DISABLED"] When `null`, the `compression_mode` field will be omitted from the resulting object.\n  - `connection_draining_timeout_sec` (`number`): Time for which instance will be drained (not accept new\nconnections, but still work to finish started). When `null`, the `connection_draining_timeout_sec` field will be omitted from the resulting object.\n  - `custom_request_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nrequests. When `null`, the `custom_request_headers` field will be omitted from the resulting object.\n  - `custom_response_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nresponses. When `null`, the `custom_response_headers` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): The resource URL for the edge security policy associated with this backend service. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `enable_cdn` (`bool`): If true, enable Cloud CDN for this BackendService. When `null`, the `enable_cdn` field will be omitted from the resulting object.\n  - `health_checks` (`list`): The set of URLs to the HttpHealthCheck or HttpsHealthCheck resource\nfor health checking this BackendService. Currently at most one health\ncheck can be specified.\n\nA health check must be specified unless the backend service uses an internet\nor serverless NEG as a backend.\n\nFor internal load balancing, a URL to a HealthCheck resource must be specified instead. When `null`, the `health_checks` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Indicates whether the backend service will be used with internal or\nexternal load balancing. A backend service created for one type of\nload balancing cannot be used with the other. For more information, refer to\n[Choosing a load balancer](https://cloud.google.com/load-balancing/docs/backend-service). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "INTERNAL_SELF_MANAGED", "INTERNAL_MANAGED", "EXTERNAL_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `locality_lb_policy` (`string`): The load balancing algorithm used within the scope of the locality.\nThe possible values are:\n\n* 'ROUND_ROBIN': This is a simple policy in which each healthy backend\n                 is selected in round robin order.\n\n* 'LEAST_REQUEST': An O(1) algorithm which selects two random healthy\n                   hosts and picks the host which has fewer active requests.\n\n* 'RING_HASH': The ring/modulo hash load balancer implements consistent\n               hashing to backends. The algorithm has the property that the\n               addition/removal of a host from a set of N hosts only affects\n               1/N of the requests.\n\n* 'RANDOM': The load balancer selects a random healthy host.\n\n* 'ORIGINAL_DESTINATION': Backend host is selected based on the client\n                          connection metadata, i.e., connections are opened\n                          to the same address as the destination address of\n                          the incoming connection before the connection\n                          was redirected to the load balancer.\n\n* 'MAGLEV': used as a drop in replacement for the ring hash load balancer.\n            Maglev is not as stable as ring hash but has faster table lookup\n            build times and host selection times. For more information about\n            Maglev, refer to https://ai.google/research/pubs/pub44824\n\n* 'WEIGHTED_MAGLEV': Per-instance weighted Load Balancing via health check\n                     reported weights. If set, the Backend Service must\n                     configure a non legacy HTTP-based Health Check, and\n                     health check replies are expected to contain\n                     non-standard HTTP response header field\n                     X-Load-Balancing-Endpoint-Weight to specify the\n                     per-instance weights. If set, Load Balancing is weight\n                     based on the per-instance weights reported in the last\n                     processed health check replies, as long as every\n                     instance either reported a valid weight or had\n                     UNAVAILABLE_WEIGHT. Otherwise, Load Balancing remains\n                     equal-weight.\n\n\nThis field is applicable to either:\n\n* A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2,\n  and loadBalancingScheme set to INTERNAL_MANAGED.\n* A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED.\n* A regional backend service with loadBalancingScheme set to EXTERNAL (External Network\n  Load Balancing). Only MAGLEV and WEIGHTED_MAGLEV values are possible for External\n  Network Load Balancing. The default is MAGLEV.\n\n\nIf session_affinity is not NONE, and this field is not set to MAGLEV, WEIGHTED_MAGLEV,\nor RING_HASH, session affinity settings will not take effect.\n\nOnly ROUND_ROBIN and RING_HASH are supported when the backend service is referenced\nby a URL map that is bound to target gRPC proxy that has validate_for_proxyless\nfield set to true. Possible values: ["ROUND_ROBIN", "LEAST_REQUEST", "RING_HASH", "RANDOM", "ORIGINAL_DESTINATION", "MAGLEV", "WEIGHTED_MAGLEV"] When `null`, the `locality_lb_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `port_name` (`string`): Name of backend port. The same name should appear in the instance\ngroups referenced by this service. Required when the load balancing\nscheme is EXTERNAL. When `null`, the `port_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol this BackendService uses to communicate with backends.\nThe default is HTTP. **NOTE**: HTTP2 is only valid for beta HTTP/2 load balancer\ntypes and may result in errors if used with the GA API. **NOTE**: With protocol “UNSPECIFIED”,\nthe backend service can be used by Layer 4 Internal Load Balancing or Network Load Balancing\nwith TCP/UDP/L3_DEFAULT Forwarding Rule protocol. Possible values: ["HTTP", "HTTPS", "HTTP2", "TCP", "SSL", "GRPC", "UNSPECIFIED"] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `security_policy` (`string`): The security policy associated with this backend service. When `null`, the `security_policy` field will be omitted from the resulting object.\n  - `session_affinity` (`string`): Type of session affinity to use. The default is NONE. Session affinity is\nnot applicable if the protocol is UDP. Possible values: ["NONE", "CLIENT_IP", "CLIENT_IP_PORT_PROTO", "CLIENT_IP_PROTO", "GENERATED_COOKIE", "HEADER_FIELD", "HTTP_COOKIE"] When `null`, the `session_affinity` field will be omitted from the resulting object.\n  - `timeout_sec` (`number`): How many seconds to wait for the backend before considering it a\nfailed request. Default is 30 seconds. Valid range is [1, 86400]. When `null`, the `timeout_sec` field will be omitted from the resulting object.\n  - `backend` (`list[obj]`): The set of backends that serve this BackendService. When `null`, the `backend` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.backend.new](#fn-backendnew) constructor.\n  - `cdn_policy` (`list[obj]`): Cloud CDN configuration for this BackendService. When `null`, the `cdn_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.cdn_policy.new](#fn-cdn_policynew) constructor.\n  - `circuit_breakers` (`list[obj]`): Settings controlling the volume of connections to a backend service. This field\nis applicable only when the load_balancing_scheme is set to INTERNAL_SELF_MANAGED. When `null`, the `circuit_breakers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.circuit_breakers.new](#fn-circuit_breakersnew) constructor.\n  - `consistent_hash` (`list[obj]`): Consistent Hash-based load balancing can be used to provide soft session\naffinity based on HTTP headers, cookies or other properties. This load balancing\npolicy is applicable only for HTTP connections. The affinity to a particular\ndestination host will be lost when one or more hosts are added/removed from the\ndestination service. This field specifies parameters that control consistent\nhashing. This field only applies if the load_balancing_scheme is set to\nINTERNAL_SELF_MANAGED. This field is only applicable when locality_lb_policy is\nset to MAGLEV or RING_HASH. When `null`, the `consistent_hash` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.consistent_hash.new](#fn-consistent_hashnew) constructor.\n  - `iap` (`list[obj]`): Settings for enabling Cloud Identity Aware Proxy When `null`, the `iap` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.iap.new](#fn-iapnew) constructor.\n  - `locality_lb_policies` (`list[obj]`): A list of locality load balancing policies to be used in order of\npreference. Either the policy or the customPolicy field should be set.\nOverrides any value set in the localityLbPolicy field.\n\nlocalityLbPolicies is only supported when the BackendService is referenced\nby a URL Map that is referenced by a target gRPC proxy that has the\nvalidateForProxyless field set to true. When `null`, the `locality_lb_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.locality_lb_policies.new](#fn-locality_lb_policiesnew) constructor.\n  - `log_config` (`list[obj]`): This field denotes the logging options for the load balancer traffic served by this backend service.\nIf logging is enabled, logs will be exported to Stackdriver. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.log_config.new](#fn-log_confignew) constructor.\n  - `outlier_detection` (`list[obj]`): Settings controlling eviction of unhealthy hosts from the load balancing pool.\nThis field is applicable only when the load_balancing_scheme is set\nto INTERNAL_SELF_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.\n  - `security_settings` (`list[obj]`): The security settings that apply to this backend service. This field is applicable to either\na regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and\nload_balancing_scheme set to INTERNAL_MANAGED; or a global backend service with the\nload_balancing_scheme set to INTERNAL_SELF_MANAGED. When `null`, the `security_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.security_settings.new](#fn-security_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_backend_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_backend_service.newAttrs` constructs a new object with attributes and blocks configured for the `compute_backend_service`\nTerraform resource.\n\nUnlike [google.compute_backend_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `affinity_cookie_ttl_sec` (`number`): Lifetime of cookies in seconds if session_affinity is\nGENERATED_COOKIE. If set to 0, the cookie is non-persistent and lasts\nonly until the end of the browser session (or equivalent). The\nmaximum allowed value for TTL is one day.\n\nWhen the load balancing scheme is INTERNAL, this field is not used. When `null`, the `affinity_cookie_ttl_sec` field will be omitted from the resulting object.\n  - `compression_mode` (`string`): Compress text responses using Brotli or gzip compression, based on the client's Accept-Encoding header. Possible values: ["AUTOMATIC", "DISABLED"] When `null`, the `compression_mode` field will be omitted from the resulting object.\n  - `connection_draining_timeout_sec` (`number`): Time for which instance will be drained (not accept new\nconnections, but still work to finish started). When `null`, the `connection_draining_timeout_sec` field will be omitted from the resulting object.\n  - `custom_request_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nrequests. When `null`, the `custom_request_headers` field will be omitted from the resulting object.\n  - `custom_response_headers` (`list`): Headers that the HTTP/S load balancer should add to proxied\nresponses. When `null`, the `custom_response_headers` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): The resource URL for the edge security policy associated with this backend service. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `enable_cdn` (`bool`): If true, enable Cloud CDN for this BackendService. When `null`, the `enable_cdn` field will be omitted from the resulting object.\n  - `health_checks` (`list`): The set of URLs to the HttpHealthCheck or HttpsHealthCheck resource\nfor health checking this BackendService. Currently at most one health\ncheck can be specified.\n\nA health check must be specified unless the backend service uses an internet\nor serverless NEG as a backend.\n\nFor internal load balancing, a URL to a HealthCheck resource must be specified instead. When `null`, the `health_checks` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Indicates whether the backend service will be used with internal or\nexternal load balancing. A backend service created for one type of\nload balancing cannot be used with the other. For more information, refer to\n[Choosing a load balancer](https://cloud.google.com/load-balancing/docs/backend-service). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "INTERNAL_SELF_MANAGED", "INTERNAL_MANAGED", "EXTERNAL_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `locality_lb_policy` (`string`): The load balancing algorithm used within the scope of the locality.\nThe possible values are:\n\n* 'ROUND_ROBIN': This is a simple policy in which each healthy backend\n                 is selected in round robin order.\n\n* 'LEAST_REQUEST': An O(1) algorithm which selects two random healthy\n                   hosts and picks the host which has fewer active requests.\n\n* 'RING_HASH': The ring/modulo hash load balancer implements consistent\n               hashing to backends. The algorithm has the property that the\n               addition/removal of a host from a set of N hosts only affects\n               1/N of the requests.\n\n* 'RANDOM': The load balancer selects a random healthy host.\n\n* 'ORIGINAL_DESTINATION': Backend host is selected based on the client\n                          connection metadata, i.e., connections are opened\n                          to the same address as the destination address of\n                          the incoming connection before the connection\n                          was redirected to the load balancer.\n\n* 'MAGLEV': used as a drop in replacement for the ring hash load balancer.\n            Maglev is not as stable as ring hash but has faster table lookup\n            build times and host selection times. For more information about\n            Maglev, refer to https://ai.google/research/pubs/pub44824\n\n* 'WEIGHTED_MAGLEV': Per-instance weighted Load Balancing via health check\n                     reported weights. If set, the Backend Service must\n                     configure a non legacy HTTP-based Health Check, and\n                     health check replies are expected to contain\n                     non-standard HTTP response header field\n                     X-Load-Balancing-Endpoint-Weight to specify the\n                     per-instance weights. If set, Load Balancing is weight\n                     based on the per-instance weights reported in the last\n                     processed health check replies, as long as every\n                     instance either reported a valid weight or had\n                     UNAVAILABLE_WEIGHT. Otherwise, Load Balancing remains\n                     equal-weight.\n\n\nThis field is applicable to either:\n\n* A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2,\n  and loadBalancingScheme set to INTERNAL_MANAGED.\n* A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED.\n* A regional backend service with loadBalancingScheme set to EXTERNAL (External Network\n  Load Balancing). Only MAGLEV and WEIGHTED_MAGLEV values are possible for External\n  Network Load Balancing. The default is MAGLEV.\n\n\nIf session_affinity is not NONE, and this field is not set to MAGLEV, WEIGHTED_MAGLEV,\nor RING_HASH, session affinity settings will not take effect.\n\nOnly ROUND_ROBIN and RING_HASH are supported when the backend service is referenced\nby a URL map that is bound to target gRPC proxy that has validate_for_proxyless\nfield set to true. Possible values: ["ROUND_ROBIN", "LEAST_REQUEST", "RING_HASH", "RANDOM", "ORIGINAL_DESTINATION", "MAGLEV", "WEIGHTED_MAGLEV"] When `null`, the `locality_lb_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `port_name` (`string`): Name of backend port. The same name should appear in the instance\ngroups referenced by this service. Required when the load balancing\nscheme is EXTERNAL. When `null`, the `port_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol this BackendService uses to communicate with backends.\nThe default is HTTP. **NOTE**: HTTP2 is only valid for beta HTTP/2 load balancer\ntypes and may result in errors if used with the GA API. **NOTE**: With protocol “UNSPECIFIED”,\nthe backend service can be used by Layer 4 Internal Load Balancing or Network Load Balancing\nwith TCP/UDP/L3_DEFAULT Forwarding Rule protocol. Possible values: ["HTTP", "HTTPS", "HTTP2", "TCP", "SSL", "GRPC", "UNSPECIFIED"] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `security_policy` (`string`): The security policy associated with this backend service. When `null`, the `security_policy` field will be omitted from the resulting object.\n  - `session_affinity` (`string`): Type of session affinity to use. The default is NONE. Session affinity is\nnot applicable if the protocol is UDP. Possible values: ["NONE", "CLIENT_IP", "CLIENT_IP_PORT_PROTO", "CLIENT_IP_PROTO", "GENERATED_COOKIE", "HEADER_FIELD", "HTTP_COOKIE"] When `null`, the `session_affinity` field will be omitted from the resulting object.\n  - `timeout_sec` (`number`): How many seconds to wait for the backend before considering it a\nfailed request. Default is 30 seconds. Valid range is [1, 86400]. When `null`, the `timeout_sec` field will be omitted from the resulting object.\n  - `backend` (`list[obj]`): The set of backends that serve this BackendService. When `null`, the `backend` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.backend.new](#fn-backendnew) constructor.\n  - `cdn_policy` (`list[obj]`): Cloud CDN configuration for this BackendService. When `null`, the `cdn_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.cdn_policy.new](#fn-cdn_policynew) constructor.\n  - `circuit_breakers` (`list[obj]`): Settings controlling the volume of connections to a backend service. This field\nis applicable only when the load_balancing_scheme is set to INTERNAL_SELF_MANAGED. When `null`, the `circuit_breakers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.circuit_breakers.new](#fn-circuit_breakersnew) constructor.\n  - `consistent_hash` (`list[obj]`): Consistent Hash-based load balancing can be used to provide soft session\naffinity based on HTTP headers, cookies or other properties. This load balancing\npolicy is applicable only for HTTP connections. The affinity to a particular\ndestination host will be lost when one or more hosts are added/removed from the\ndestination service. This field specifies parameters that control consistent\nhashing. This field only applies if the load_balancing_scheme is set to\nINTERNAL_SELF_MANAGED. This field is only applicable when locality_lb_policy is\nset to MAGLEV or RING_HASH. When `null`, the `consistent_hash` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.consistent_hash.new](#fn-consistent_hashnew) constructor.\n  - `iap` (`list[obj]`): Settings for enabling Cloud Identity Aware Proxy When `null`, the `iap` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.iap.new](#fn-iapnew) constructor.\n  - `locality_lb_policies` (`list[obj]`): A list of locality load balancing policies to be used in order of\npreference. Either the policy or the customPolicy field should be set.\nOverrides any value set in the localityLbPolicy field.\n\nlocalityLbPolicies is only supported when the BackendService is referenced\nby a URL Map that is referenced by a target gRPC proxy that has the\nvalidateForProxyless field set to true. When `null`, the `locality_lb_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.locality_lb_policies.new](#fn-locality_lb_policiesnew) constructor.\n  - `log_config` (`list[obj]`): This field denotes the logging options for the load balancer traffic served by this backend service.\nIf logging is enabled, logs will be exported to Stackdriver. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.log_config.new](#fn-log_confignew) constructor.\n  - `outlier_detection` (`list[obj]`): Settings controlling eviction of unhealthy hosts from the load balancing pool.\nApplicable backend service types can be a global backend service with the\nloadBalancingScheme set to INTERNAL_SELF_MANAGED or EXTERNAL_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.\n  - `security_settings` (`list[obj]`): The security settings that apply to this backend service. This field is applicable to either\na regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and\nload_balancing_scheme set to INTERNAL_MANAGED; or a global backend service with the\nload_balancing_scheme set to INTERNAL_SELF_MANAGED. When `null`, the `security_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.security_settings.new](#fn-security_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_backend_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     affinity_cookie_ttl_sec=null,
diff --git a/4.x/_gen/resources/compute_disk.libsonnet b/4.x/_gen/resources/compute_disk.libsonnet
index 72a2ba86..b582a365 100644
--- a/4.x/_gen/resources/compute_disk.libsonnet
+++ b/4.x/_gen/resources/compute_disk.libsonnet
@@ -32,13 +32,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_disk.new` injects a new `google_compute_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_disk` using the reference:\n\n    $._ref.google_compute_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image\u0026#39;s \u0026#39;self_link\u0026#39;, \u0026#39;projects/{project}/global/images/{image}\u0026#39;,\n\u0026#39;projects/{project}/global/images/family/{family}\u0026#39;, \u0026#39;global/images/{image}\u0026#39;,\n\u0026#39;global/images/family/{family}\u0026#39;, \u0026#39;family/{family}\u0026#39;, \u0026#39;{project}/{family}\u0026#39;,\n\u0026#39;{project}/{image}\u0026#39;, \u0026#39;{family}\u0026#39;, or \u0026#39;{image}\u0026#39;. If referred by family, the\nimages names must include the family name. If they don\u0026#39;t, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image \u0026#39;centos-6-v20180104\u0026#39; includes its family name \u0026#39;centos-6\u0026#39;.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the \u0026#39;image\u0026#39; or\n\u0026#39;snapshot\u0026#39; parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with \u0026#39;image\u0026#39; or \u0026#39;snapshot\u0026#39;,\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~\u0026gt;**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add \u0026#39;lifecycle.prevent_destroy\u0026#39; in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_disk.new` injects a new `google_compute_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_disk` using the reference:\n\n    $._ref.google_compute_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_confidential_compute` (`bool`): Whether this disk is using confidential compute mode.\nNote: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image\u0026#39;s \u0026#39;self_link\u0026#39;, \u0026#39;projects/{project}/global/images/{image}\u0026#39;,\n\u0026#39;projects/{project}/global/images/family/{family}\u0026#39;, \u0026#39;global/images/{image}\u0026#39;,\n\u0026#39;global/images/family/{family}\u0026#39;, \u0026#39;family/{family}\u0026#39;, \u0026#39;{project}/{family}\u0026#39;,\n\u0026#39;{project}/{image}\u0026#39;, \u0026#39;{family}\u0026#39;, or \u0026#39;{image}\u0026#39;. If referred by family, the\nimages names must include the family name. If they don\u0026#39;t, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image \u0026#39;centos-6-v20180104\u0026#39; includes its family name \u0026#39;centos-6\u0026#39;.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the \u0026#39;image\u0026#39; or\n\u0026#39;snapshot\u0026#39; parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with \u0026#39;image\u0026#39; or \u0026#39;snapshot\u0026#39;,\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~\u0026gt;**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add \u0026#39;lifecycle.prevent_destroy\u0026#39; in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
     async_primary_disk=null,
     description=null,
     disk_encryption_key=null,
+    enable_confidential_compute=null,
     guest_os_features=null,
     image=null,
     labels=null,
@@ -63,6 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       async_primary_disk=async_primary_disk,
       description=description,
       disk_encryption_key=disk_encryption_key,
+      enable_confidential_compute=enable_confidential_compute,
       guest_os_features=guest_os_features,
       image=image,
       labels=labels,
@@ -83,12 +85,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_disk`\nTerraform resource.\n\nUnlike [google.compute_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image's 'self_link', 'projects/{project}/global/images/{image}',\n'projects/{project}/global/images/family/{family}', 'global/images/{image}',\n'global/images/family/{family}', 'family/{family}', '{project}/{family}',\n'{project}/{image}', '{family}', or '{image}'. If referred by family, the\nimages names must include the family name. If they don't, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the 'image' or\n'snapshot' parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with 'image' or 'snapshot',\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~>**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add 'lifecycle.prevent_destroy' in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_disk` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_disk`\nTerraform resource.\n\nUnlike [google.compute_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_confidential_compute` (`bool`): Whether this disk is using confidential compute mode.\nNote: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image's 'self_link', 'projects/{project}/global/images/{image}',\n'projects/{project}/global/images/family/{family}', 'global/images/{image}',\n'global/images/family/{family}', 'family/{family}', '{project}/{family}',\n'{project}/{image}', '{family}', or '{image}'. If referred by family, the\nimages names must include the family name. If they don't, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the 'image' or\n'snapshot' parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with 'image' or 'snapshot',\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~>**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add 'lifecycle.prevent_destroy' in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_disk` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     async_primary_disk=null,
     description=null,
     disk_encryption_key=null,
+    enable_confidential_compute=null,
     guest_os_features=null,
     image=null,
     labels=null,
@@ -109,6 +112,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     async_primary_disk: async_primary_disk,
     description: description,
     disk_encryption_key: disk_encryption_key,
+    enable_confidential_compute: enable_confidential_compute,
     guest_os_features: guest_os_features,
     image: image,
     labels: labels,
@@ -213,6 +217,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEnableConfidentialCompute':: d.fn(help='`google.bool.withEnableConfidentialCompute` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_confidential_compute field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_confidential_compute` field.\n', args=[]),
+  withEnableConfidentialCompute(resourceLabel, value): {
+    resource+: {
+      google_compute_disk+: {
+        [resourceLabel]+: {
+          enable_confidential_compute: value,
+        },
+      },
+    },
+  },
   '#withGuestOsFeatures':: d.fn(help='`google.list[obj].withGuestOsFeatures` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the guest_os_features field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGuestOsFeaturesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `guest_os_features` field.\n', args=[]),
   withGuestOsFeatures(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet b/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet
index e403f622..24bb4fc0 100644
--- a/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet
+++ b/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       ip_address: ip_address,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_external_vpn_gateway.new` injects a new `google_compute_external_vpn_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_external_vpn_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_external_vpn_gateway` using the reference:\n\n    $._ref.google_compute_external_vpn_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_external_vpn_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: [\u0026#34;FOUR_IPS_REDUNDANCY\u0026#34;, \u0026#34;SINGLE_IP_INTERNALLY_REDUNDANT\u0026#34;, \u0026#34;TWO_IPS_REDUNDANCY\u0026#34;] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_external_vpn_gateway.new` injects a new `google_compute_external_vpn_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_external_vpn_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_external_vpn_gateway` using the reference:\n\n    $._ref.google_compute_external_vpn_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_external_vpn_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: [\u0026#34;FOUR_IPS_REDUNDANCY\u0026#34;, \u0026#34;SINGLE_IP_INTERNALLY_REDUNDANT\u0026#34;, \u0026#34;TWO_IPS_REDUNDANCY\u0026#34;] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_external_vpn_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `compute_external_vpn_gateway`\nTerraform resource.\n\nUnlike [google.compute_external_vpn_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: ["FOUR_IPS_REDUNDANCY", "SINGLE_IP_INTERNALLY_REDUNDANT", "TWO_IPS_REDUNDANCY"] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_external_vpn_gateway` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_external_vpn_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `compute_external_vpn_gateway`\nTerraform resource.\n\nUnlike [google.compute_external_vpn_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: ["FOUR_IPS_REDUNDANCY", "SINGLE_IP_INTERNALLY_REDUNDANT", "TWO_IPS_REDUNDANCY"] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_external_vpn_gateway` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/compute_forwarding_rule.libsonnet b/4.x/_gen/resources/compute_forwarding_rule.libsonnet
index 6c3c99e0..1d071c1b 100644
--- a/4.x/_gen/resources/compute_forwarding_rule.libsonnet
+++ b/4.x/_gen/resources/compute_forwarding_rule.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_forwarding_rule', url='', help='`compute_forwarding_rule` represents the `google_compute_forwarding_rule` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_forwarding_rule.new` injects a new `google_compute_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_forwarding_rule` using the reference:\n\n    $._ref.google_compute_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `all_ports` (`bool`): This field can only be used:\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, and internal and external protocol forwarding.\n\nThis option should be set to TRUE when the Forwarding Rule\nIPProtocol is set to L3_DEFAULT.\n\nSet this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule.\n\nThe \u0026#39;ports\u0026#39;, \u0026#39;port_range\u0026#39;, and\n\u0026#39;allPorts\u0026#39; fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the \u0026#39;backend_service\u0026#39; field for\ninternal load balancing or with the \u0026#39;target\u0026#39; field for internal\nTargetInstance.\n\nIf the field is set to \u0026#39;TRUE\u0026#39;, clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with \u0026#34;L3_DEFAULT\u0026#34; IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;, \u0026#34;L3_DEFAULT\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n\u0026#39;PacketMirroring\u0026#39; rule applies to them.\n\nThis can only be set to true for load balancers that have their\n\u0026#39;loadBalancingScheme\u0026#39; set to \u0026#39;INTERNAL\u0026#39;. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n\u0026#39;PREMIUM\u0026#39;, \u0026#39;STANDARD\u0026#39;.\n\nFor regional ForwardingRule, the valid values are \u0026#39;PREMIUM\u0026#39; and\n\u0026#39;STANDARD\u0026#39;. For GlobalForwardingRule, the valid value is\n\u0026#39;PREMIUM\u0026#39;.\n\nIf this field is not specified, it is assumed to be \u0026#39;PREMIUM\u0026#39;.\nIf \u0026#39;IPAddress\u0026#39; is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\nOnly packets addressed to ports in the specified range will be forwarded to\nthe backends configured with this forwarding rule.\n\nThe \u0026#39;ports\u0026#39; and \u0026#39;port_range\u0026#39; fields are mutually exclusive.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot have\noverlapping \u0026#39;portRange\u0026#39;s.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39;\npair, and cannot have overlapping \u0026#39;portRange\u0026#39;s. When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): This field can only be used:\n\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, internal protocol forwarding and when protocol is not L3_DEFAULT.\n\n\nYou can specify a list of up to five ports by number, separated by commas.\nThe ports can be contiguous or discontiguous. Only packets addressed to\nthese ports will be forwarded to the backends configured with this\nforwarding rule.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot share any values\ndefined in \u0026#39;ports\u0026#39;.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39;\npair, and cannot share any values defined in \u0026#39;ports\u0026#39;.\n\nThe \u0026#39;ports\u0026#39; and \u0026#39;port_range\u0026#39; fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_forwarding_rule.new` injects a new `google_compute_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_forwarding_rule` using the reference:\n\n    $._ref.google_compute_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `all_ports` (`bool`): The \u0026#39;ports\u0026#39;, \u0026#39;portRange\u0026#39;, and \u0026#39;allPorts\u0026#39; fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe \u0026#39;allPorts\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, SCTP, or\nL3_DEFAULT.\n* It\u0026#39;s applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal and external protocol forwarding.\n* Set this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule. The L3_DEFAULT protocol requires \u0026#39;allPorts\u0026#39; be set to\ntrue. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the \u0026#39;backend_service\u0026#39; field for\ninternal load balancing or with the \u0026#39;target\u0026#39; field for internal\nTargetInstance.\n\nIf the field is set to \u0026#39;TRUE\u0026#39;, clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with \u0026#34;L3_DEFAULT\u0026#34; IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;, \u0026#34;L3_DEFAULT\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n\u0026#39;PacketMirroring\u0026#39; rule applies to them.\n\nThis can only be set to true for load balancers that have their\n\u0026#39;loadBalancingScheme\u0026#39; set to \u0026#39;INTERNAL\u0026#39;. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n\u0026#39;PREMIUM\u0026#39;, \u0026#39;STANDARD\u0026#39;.\n\nFor regional ForwardingRule, the valid values are \u0026#39;PREMIUM\u0026#39; and\n\u0026#39;STANDARD\u0026#39;. For GlobalForwardingRule, the valid value is\n\u0026#39;PREMIUM\u0026#39;.\n\nIf this field is not specified, it is assumed to be \u0026#39;PREMIUM\u0026#39;.\nIf \u0026#39;IPAddress\u0026#39; is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The \u0026#39;ports\u0026#39;, \u0026#39;portRange\u0026#39;, and \u0026#39;allPorts\u0026#39; fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe \u0026#39;portRange\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, or SCTP,\nand\n* It\u0026#39;s applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot have overlapping\n\u0026#39;portRange\u0026#39;s.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and\ncannot have overlapping \u0026#39;portRange\u0026#39;s.\n\n@pattern: \\d\u0026#43;(?:-\\d\u0026#43;)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): The \u0026#39;ports\u0026#39;, \u0026#39;portRange\u0026#39;, and \u0026#39;allPorts\u0026#39; fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe \u0026#39;ports\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, or SCTP,\nand\n* It\u0026#39;s applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal protocol forwarding.\n* You can specify a list of up to five ports by number, separated by\ncommas. The ports can be contiguous or discontiguous.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair if they share at least one port\nnumber.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair if\nthey share at least one port number.\n\n@pattern: \\d\u0026#43;(?:-\\d\u0026#43;)? When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     port_range=null,
     ports=null,
     project=null,
+    recreate_closed_psc=null,
     region=null,
     service_directory_registrations=null,
     service_label=null,
@@ -53,6 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       port_range=port_range,
       ports=ports,
       project=project,
+      recreate_closed_psc=recreate_closed_psc,
       region=region,
       service_directory_registrations=service_directory_registrations,
       service_label=service_label,
@@ -63,7 +65,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `all_ports` (`bool`): This field can only be used:\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, and internal and external protocol forwarding.\n\nThis option should be set to TRUE when the Forwarding Rule\nIPProtocol is set to L3_DEFAULT.\n\nSet this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule.\n\nThe 'ports', 'port_range', and\n'allPorts' fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for\ninternal load balancing or with the 'target' field for internal\nTargetInstance.\n\nIf the field is set to 'TRUE', clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target' or 'backendService'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target' or 'backendService',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with "L3_DEFAULT" IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP", "L3_DEFAULT"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n'PacketMirroring' rule applies to them.\n\nThis can only be set to true for load balancers that have their\n'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n'PREMIUM', 'STANDARD'.\n\nFor regional ForwardingRule, the valid values are 'PREMIUM' and\n'STANDARD'. For GlobalForwardingRule, the valid value is\n'PREMIUM'.\n\nIf this field is not specified, it is assumed to be 'PREMIUM'.\nIf 'IPAddress' is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\nOnly packets addressed to ports in the specified range will be forwarded to\nthe backends configured with this forwarding rule.\n\nThe 'ports' and 'port_range' fields are mutually exclusive.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot have\noverlapping 'portRange's.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]'\npair, and cannot have overlapping 'portRange's. When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): This field can only be used:\n\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, internal protocol forwarding and when protocol is not L3_DEFAULT.\n\n\nYou can specify a list of up to five ports by number, separated by commas.\nThe ports can be contiguous or discontiguous. Only packets addressed to\nthese ports will be forwarded to the backends configured with this\nforwarding rule.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot share any values\ndefined in 'ports'.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]'\npair, and cannot share any values defined in 'ports'.\n\nThe 'ports' and 'port_range' fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `all_ports` (`bool`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe 'allPorts' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, SCTP, or\nL3_DEFAULT.\n* It's applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal and external protocol forwarding.\n* Set this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule. The L3_DEFAULT protocol requires 'allPorts' be set to\ntrue. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for\ninternal load balancing or with the 'target' field for internal\nTargetInstance.\n\nIf the field is set to 'TRUE', clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target' or 'backendService'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target' or 'backendService',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with "L3_DEFAULT" IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP", "L3_DEFAULT"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n'PacketMirroring' rule applies to them.\n\nThis can only be set to true for load balancers that have their\n'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n'PREMIUM', 'STANDARD'.\n\nFor regional ForwardingRule, the valid values are 'PREMIUM' and\n'STANDARD'. For GlobalForwardingRule, the valid value is\n'PREMIUM'.\n\nIf this field is not specified, it is assumed to be 'PREMIUM'.\nIf 'IPAddress' is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe 'portRange' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,\nand\n* It's applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot have overlapping\n'portRange's.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and\ncannot have overlapping 'portRange's.\n\n@pattern: \\d+(?:-\\d+)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe 'ports' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,\nand\n* It's applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal protocol forwarding.\n* You can specify a list of up to five ports by number, separated by\ncommas. The ports can be contiguous or discontiguous.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair if they share at least one port\nnumber.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]' pair if\nthey share at least one port number.\n\n@pattern: \\d+(?:-\\d+)? When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     all_ports=null,
@@ -83,6 +85,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     port_range=null,
     ports=null,
     project=null,
+    recreate_closed_psc=null,
     region=null,
     service_directory_registrations=null,
     service_label=null,
@@ -109,6 +112,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     port_range: port_range,
     ports: ports,
     project: project,
+    recreate_closed_psc: recreate_closed_psc,
     region: region,
     service_directory_registrations: service_directory_registrations,
     service_label: service_label,
@@ -319,6 +323,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRecreateClosedPsc':: d.fn(help='`google.bool.withRecreateClosedPsc` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the recreate_closed_psc field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `recreate_closed_psc` field.\n', args=[]),
+  withRecreateClosedPsc(resourceLabel, value): {
+    resource+: {
+      google_compute_forwarding_rule+: {
+        [resourceLabel]+: {
+          recreate_closed_psc: value,
+        },
+      },
+    },
+  },
   '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
   withRegion(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet b/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet
index 83b592b9..3c9ca2a2 100644
--- a/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet
+++ b/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       filter_match_criteria: filter_match_criteria,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_global_forwarding_rule.new` injects a new `google_compute_global_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_global_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_global_forwarding_rule` using the reference:\n\n    $._ref.google_compute_global_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_global_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_SELF_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\n* TargetHttpProxy: 80, 8080\n* TargetHttpsProxy: 443\n* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_global_forwarding_rule.new` injects a new `google_compute_global_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_global_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_global_forwarding_rule` using the reference:\n\n    $._ref.google_compute_global_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_global_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_SELF_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The \u0026#39;portRange\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, or SCTP,\nand\n* It\u0026#39;s applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot have overlapping\n\u0026#39;portRange\u0026#39;s.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and\ncannot have overlapping \u0026#39;portRange\u0026#39;s.\n\n@pattern: \\d\u0026#43;(?:-\\d\u0026#43;)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -38,6 +38,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     no_automate_dns_zone=null,
     port_range=null,
     project=null,
+    service_directory_registrations=null,
     source_ip_ranges=null,
     subnetwork=null,
     timeouts=null,
@@ -58,6 +59,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       no_automate_dns_zone=no_automate_dns_zone,
       port_range=port_range,
       project=project,
+      service_directory_registrations=service_directory_registrations,
       source_ip_ranges=source_ip_ranges,
       subnetwork=subnetwork,
       target=target,
@@ -65,7 +67,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_global_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_global_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_global_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL_MANAGED", "INTERNAL_SELF_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\n* TargetHttpProxy: 80, 8080\n* TargetHttpsProxy: 443\n* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_global_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_global_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_global_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_global_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL_MANAGED", "INTERNAL_SELF_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The 'portRange' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,\nand\n* It's applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot have overlapping\n'portRange's.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and\ncannot have overlapping 'portRange's.\n\n@pattern: \\d+(?:-\\d+)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_global_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     target,
@@ -80,6 +82,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     no_automate_dns_zone=null,
     port_range=null,
     project=null,
+    service_directory_registrations=null,
     source_ip_ranges=null,
     subnetwork=null,
     timeouts=null
@@ -96,11 +99,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     no_automate_dns_zone: no_automate_dns_zone,
     port_range: port_range,
     project: project,
+    service_directory_registrations: service_directory_registrations,
     source_ip_ranges: source_ip_ranges,
     subnetwork: subnetwork,
     target: target,
     timeouts: timeouts,
   }),
+  service_directory_registrations:: {
+    '#new':: d.fn(help='\n`google.compute_global_forwarding_rule.service_directory_registrations.new` constructs a new object with attributes and blocks configured for the `service_directory_registrations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `namespace` (`string`): Service Directory namespace to register the forwarding rule under. When `null`, the `namespace` field will be omitted from the resulting object.\n  - `service_directory_region` (`string`): [Optional] Service Directory region to register this global forwarding rule under.\nDefault to "us-central1". Only used for PSC for Google APIs. All PSC for\nGoogle APIs Forwarding Rules on the same network should use the same Service\nDirectory region. When `null`, the `service_directory_region` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `service_directory_registrations` sub block.\n', args=[]),
+    new(
+      namespace=null,
+      service_directory_region=null
+    ):: std.prune(a={
+      namespace: namespace,
+      service_directory_region: service_directory_region,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.compute_global_forwarding_rule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -243,6 +257,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withServiceDirectoryRegistrations':: d.fn(help='`google.list[obj].withServiceDirectoryRegistrations` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the service_directory_registrations field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withServiceDirectoryRegistrationsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `service_directory_registrations` field.\n', args=[]),
+  withServiceDirectoryRegistrations(resourceLabel, value): {
+    resource+: {
+      google_compute_global_forwarding_rule+: {
+        [resourceLabel]+: {
+          service_directory_registrations: value,
+        },
+      },
+    },
+  },
+  '#withServiceDirectoryRegistrationsMixin':: d.fn(help='`google.list[obj].withServiceDirectoryRegistrationsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the service_directory_registrations field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withServiceDirectoryRegistrations](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `service_directory_registrations` field.\n', args=[]),
+  withServiceDirectoryRegistrationsMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_global_forwarding_rule+: {
+        [resourceLabel]+: {
+          service_directory_registrations+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withSourceIpRanges':: d.fn(help='`google.list.withSourceIpRanges` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the source_ip_ranges field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `source_ip_ranges` field.\n', args=[]),
   withSourceIpRanges(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_image.libsonnet b/4.x/_gen/resources/compute_image.libsonnet
index 9d2c88e2..52b4ec2a 100644
--- a/4.x/_gen/resources/compute_image.libsonnet
+++ b/4.x/_gen/resources/compute_image.libsonnet
@@ -3,7 +3,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_image', url='', help='`compute_image` represents the `google_compute_image` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   guest_os_features:: {
-    '#new':: d.fn(help='\n`google.compute_image.guest_os_features.new` constructs a new object with attributes and blocks configured for the `guest_os_features`\nTerraform sub block.\n\n\n\n**Args**:\n  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE"]\n\n**Returns**:\n  - An attribute object that represents the `guest_os_features` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_image.guest_os_features.new` constructs a new object with attributes and blocks configured for the `guest_os_features`\nTerraform sub block.\n\n\n\n**Args**:\n  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE", "SEV_LIVE_MIGRATABLE_V2"]\n\n**Returns**:\n  - An attribute object that represents the `guest_os_features` sub block.\n', args=[]),
     new(
       type
     ):: std.prune(a={
@@ -20,7 +20,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_service_account: kms_key_service_account,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_image.new` injects a new `google_compute_image` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_image.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_image` using the reference:\n\n    $._ref.google_compute_image.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_image.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_image.new` injects a new `google_compute_image` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_image.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_image` using the reference:\n\n    $._ref.google_compute_image.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_image.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -61,7 +61,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_image.newAttrs` constructs a new object with attributes and blocks configured for the `compute_image`\nTerraform resource.\n\nUnlike [google.compute_image.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_image` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_image.newAttrs` constructs a new object with attributes and blocks configured for the `compute_image`\nTerraform resource.\n\nUnlike [google.compute_image.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_image` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/compute_instance.libsonnet b/4.x/_gen/resources/compute_instance.libsonnet
index 09a8cba7..b5618bb7 100644
--- a/4.x/_gen/resources/compute_instance.libsonnet
+++ b/4.x/_gen/resources/compute_instance.libsonnet
@@ -32,16 +32,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   },
   boot_disk:: {
     initialize_params:: {
-      '#new':: d.fn(help='\n`google.compute_instance.boot_disk.initialize_params.new` constructs a new object with attributes and blocks configured for the `initialize_params`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image` (`string`): The image from which this disk was initialised. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the disk. When `null`, the `labels` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `size` (`number`): The size of the image in gigabytes. When `null`, the `size` field will be omitted from the resulting object.\n  - `type` (`string`): The Google Compute Engine disk type. Such as pd-standard, pd-ssd or pd-balanced. When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `initialize_params` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.compute_instance.boot_disk.initialize_params.new` constructs a new object with attributes and blocks configured for the `initialize_params`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_confidential_compute` (`bool`): A flag to enable confidential compute mode on boot disk When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which this disk was initialised. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the disk. When `null`, the `labels` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be between 1 and 7,124. When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `size` (`number`): The size of the image in gigabytes. When `null`, the `size` field will be omitted from the resulting object.\n  - `type` (`string`): The Google Compute Engine disk type. Such as pd-standard, pd-ssd or pd-balanced. When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `initialize_params` sub block.\n', args=[]),
       new(
+        enable_confidential_compute=null,
         image=null,
         labels=null,
+        provisioned_iops=null,
+        provisioned_throughput=null,
         resource_manager_tags=null,
         size=null,
         type=null
       ):: std.prune(a={
+        enable_confidential_compute: enable_confidential_compute,
         image: image,
         labels: labels,
+        provisioned_iops: provisioned_iops,
+        provisioned_throughput: provisioned_throughput,
         resource_manager_tags: resource_manager_tags,
         size: size,
         type: type,
@@ -150,7 +156,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance.new` injects a new `google_compute_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance` using the reference:\n\n    $._ref.google_compute_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance.new` injects a new `google_compute_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance` using the reference:\n\n    $._ref.google_compute_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     machine_type,
@@ -223,7 +229,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance`\nTerraform resource.\n\nUnlike [google.compute_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance`\nTerraform resource.\n\nUnlike [google.compute_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     machine_type,
     name,
@@ -362,11 +368,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     },
   },
   scratch_disk:: {
-    '#new':: d.fn(help='\n`google.compute_instance.scratch_disk.new` constructs a new object with attributes and blocks configured for the `scratch_disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `interface` (`string`): The disk interface used for attaching this disk. One of SCSI or NVME.\n  - `size` (`number`): The size of the disk in gigabytes. One of 375 or 3000. When `null`, the `size` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `scratch_disk` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_instance.scratch_disk.new` constructs a new object with attributes and blocks configured for the `scratch_disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `device_name` (`string`): Name with which the attached disk is accessible under /dev/disk/by-id/ When `null`, the `device_name` field will be omitted from the resulting object.\n  - `interface` (`string`): The disk interface used for attaching this disk. One of SCSI or NVME.\n  - `size` (`number`): The size of the disk in gigabytes. One of 375 or 3000. When `null`, the `size` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `scratch_disk` sub block.\n', args=[]),
     new(
       interface,
+      device_name=null,
       size=null
     ):: std.prune(a={
+      device_name: device_name,
       interface: interface,
       size: size,
     }),
diff --git a/4.x/_gen/resources/compute_instance_from_template.libsonnet b/4.x/_gen/resources/compute_instance_from_template.libsonnet
index 7135d229..e8758322 100644
--- a/4.x/_gen/resources/compute_instance_from_template.libsonnet
+++ b/4.x/_gen/resources/compute_instance_from_template.libsonnet
@@ -16,16 +16,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   },
   boot_disk:: {
     initialize_params:: {
-      '#new':: d.fn(help='\n`google.compute_instance_from_template.boot_disk.initialize_params.new` constructs a new object with attributes and blocks configured for the `initialize_params`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image` (`string`): The image from which this disk was initialised. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the disk. When `null`, the `labels` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `size` (`number`): The size of the image in gigabytes. When `null`, the `size` field will be omitted from the resulting object.\n  - `type` (`string`): The Google Compute Engine disk type. Such as pd-standard, pd-ssd or pd-balanced. When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `initialize_params` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.compute_instance_from_template.boot_disk.initialize_params.new` constructs a new object with attributes and blocks configured for the `initialize_params`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_confidential_compute` (`bool`): A flag to enable confidential compute mode on boot disk When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which this disk was initialised. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the disk. When `null`, the `labels` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be between 1 and 7,124. When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `size` (`number`): The size of the image in gigabytes. When `null`, the `size` field will be omitted from the resulting object.\n  - `type` (`string`): The Google Compute Engine disk type. Such as pd-standard, pd-ssd or pd-balanced. When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `initialize_params` sub block.\n', args=[]),
       new(
+        enable_confidential_compute=null,
         image=null,
         labels=null,
+        provisioned_iops=null,
+        provisioned_throughput=null,
         resource_manager_tags=null,
         size=null,
         type=null
       ):: std.prune(a={
+        enable_confidential_compute: enable_confidential_compute,
         image: image,
         labels: labels,
+        provisioned_iops: provisioned_iops,
+        provisioned_throughput: provisioned_throughput,
         resource_manager_tags: resource_manager_tags,
         size: size,
         type: type,
@@ -112,7 +118,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance_from_template.new` injects a new `google_compute_instance_from_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_from_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_from_template` using the reference:\n\n    $._ref.google_compute_instance_from_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_from_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance_from_template.new` injects a new `google_compute_instance_from_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_from_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_from_template` using the reference:\n\n    $._ref.google_compute_instance_from_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_from_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -187,7 +193,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance_from_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_from_template`\nTerraform resource.\n\nUnlike [google.compute_instance_from_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_from_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance_from_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_from_template`\nTerraform resource.\n\nUnlike [google.compute_instance_from_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_from_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     source_instance_template,
diff --git a/4.x/_gen/resources/compute_instance_group_manager.libsonnet b/4.x/_gen/resources/compute_instance_group_manager.libsonnet
index a9d81bd4..92f623e2 100644
--- a/4.x/_gen/resources/compute_instance_group_manager.libsonnet
+++ b/4.x/_gen/resources/compute_instance_group_manager.libsonnet
@@ -30,7 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       port: port,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance_group_manager.new` injects a new `google_compute_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_group_manager` using the reference:\n\n    $._ref.google_compute_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance_group_manager.new` injects a new `google_compute_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_group_manager` using the reference:\n\n    $._ref.google_compute_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     base_instance_name,
@@ -42,6 +42,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     named_port=null,
     project=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -64,6 +66,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       named_port=named_port,
       project=project,
       stateful_disk=stateful_disk,
+      stateful_external_ip=stateful_external_ip,
+      stateful_internal_ip=stateful_internal_ip,
       target_pools=target_pools,
       target_size=target_size,
       timeouts=timeouts,
@@ -75,7 +79,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     base_instance_name,
     name,
@@ -86,6 +90,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     named_port=null,
     project=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -104,6 +110,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     named_port: named_port,
     project: project,
     stateful_disk: stateful_disk,
+    stateful_external_ip: stateful_external_ip,
+    stateful_internal_ip: stateful_internal_ip,
     target_pools: target_pools,
     target_size: target_size,
     timeouts: timeouts,
@@ -123,6 +131,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       device_name: device_name,
     }),
   },
+  stateful_external_ip:: {
+    '#new':: d.fn(help='\n`google.compute_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_external_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
+  stateful_internal_ip:: {
+    '#new':: d.fn(help='\n`google.compute_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_internal_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.compute_instance_group_manager.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -309,6 +337,46 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStatefulExternalIp':: d.fn(help='`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulExternalIpMixin':: d.fn(help='`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIp':: d.fn(help='`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIpMixin':: d.fn(help='`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTargetPools':: d.fn(help='`google.list.withTargetPools` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the target_pools field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `target_pools` field.\n', args=[]),
   withTargetPools(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_instance_template.libsonnet b/4.x/_gen/resources/compute_instance_template.libsonnet
index 1fffedac..0b618911 100644
--- a/4.x/_gen/resources/compute_instance_template.libsonnet
+++ b/4.x/_gen/resources/compute_instance_template.libsonnet
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         kms_key_self_link: kms_key_self_link,
       }),
     },
-    '#new':: d.fn(help='\n`google.compute_instance_template.disk.new` constructs a new object with attributes and blocks configured for the `disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`bool`): Whether or not the disk should be auto-deleted. This defaults to true. When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `boot` (`bool`): Indicates that this is a boot disk. When `null`, the `boot` field will be omitted from the resulting object.\n  - `device_name` (`string`): A unique device name that is reflected into the /dev/ tree of a Linux operating system running within the instance. If not specified, the server chooses a default device name to apply to this disk. When `null`, the `device_name` field will be omitted from the resulting object.\n  - `disk_name` (`string`): Name of the disk. When not provided, this defaults to the name of the instance. When `null`, the `disk_name` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): The size of the image in gigabytes. If not specified, it will inherit the size of its base image. For SCRATCH disks, the size must be one of 375 or 3000 GB, with a default of 375 GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): The Google Compute Engine disk type. Such as "pd-ssd", "local-ssd", "pd-balanced" or "pd-standard". When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `interface` (`string`): Specifies the disk interface to use for attaching this disk. When `null`, the `interface` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to disks, When `null`, the `labels` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If you are attaching or creating a boot disk, this must read-write mode. When `null`, the `mode` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk). When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list (short name or id) of resource policies to attach to this disk. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `source` (`string`): The name (not self_link) of the disk (such as those managed by google_compute_disk) to attach. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source` field will be omitted from the resulting object.\n  - `source_image` (`string`): The image from which to initialize this disk. This can be one of: the image's self_link, projects/{project}/global/images/{image}, projects/{project}/global/images/family/{family}, global/images/{image}, global/images/family/{family}, family/{family}, {project}/{family}, {project}/{image}, {family}, or {image}. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): The source snapshot to create this disk. When creating\na new instance, one of initializeParams.sourceSnapshot,\ninitializeParams.sourceImage, or disks.source is\nrequired except for local SSD. When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `type` (`string`): The type of Google Compute Engine disk, can be either "SCRATCH" or "PERSISTENT". When `null`, the `type` field will be omitted from the resulting object.\n  - `disk_encryption_key` (`list[obj]`): Encrypts or decrypts a disk using a customer-supplied encryption key. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.disk_encryption_key.new](#fn-diskdisk_encryption_keynew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source\nimage. Required if the source image is protected by a\ncustomer-supplied encryption key.\n\nInstance templates do not store customer-supplied\nencryption keys, so you cannot create disks for\ninstances in a managed instance group if the source\nimages are encrypted with your own keys. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.source_image_encryption_key.new](#fn-disksource_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.source_snapshot_encryption_key.new](#fn-disksource_snapshot_encryption_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `disk` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_instance_template.disk.new` constructs a new object with attributes and blocks configured for the `disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`bool`): Whether or not the disk should be auto-deleted. This defaults to true. When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `boot` (`bool`): Indicates that this is a boot disk. When `null`, the `boot` field will be omitted from the resulting object.\n  - `device_name` (`string`): A unique device name that is reflected into the /dev/ tree of a Linux operating system running within the instance. If not specified, the server chooses a default device name to apply to this disk. When `null`, the `device_name` field will be omitted from the resulting object.\n  - `disk_name` (`string`): Name of the disk. When not provided, this defaults to the name of the instance. When `null`, the `disk_name` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): The size of the image in gigabytes. If not specified, it will inherit the size of its base image. For SCRATCH disks, the size must be one of 375 or 3000 GB, with a default of 375 GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): The Google Compute Engine disk type. Such as "pd-ssd", "local-ssd", "pd-balanced" or "pd-standard". When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `interface` (`string`): Specifies the disk interface to use for attaching this disk. When `null`, the `interface` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to disks, When `null`, the `labels` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If you are attaching or creating a boot disk, this must read-write mode. When `null`, the `mode` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk). When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list (short name or id) of resource policies to attach to this disk. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `source` (`string`): The name (not self_link) of the disk (such as those managed by google_compute_disk) to attach. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source` field will be omitted from the resulting object.\n  - `source_image` (`string`): The image from which to initialize this disk. This can be one of: the image's self_link, projects/{project}/global/images/{image}, projects/{project}/global/images/family/{family}, global/images/{image}, global/images/family/{family}, family/{family}, {project}/{family}, {project}/{image}, {family}, or {image}. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): The source snapshot to create this disk. When creating\na new instance, one of initializeParams.sourceSnapshot,\ninitializeParams.sourceImage, or disks.source is\nrequired except for local SSD. When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `type` (`string`): The type of Google Compute Engine disk, can be either "SCRATCH" or "PERSISTENT". When `null`, the `type` field will be omitted from the resulting object.\n  - `disk_encryption_key` (`list[obj]`): Encrypts or decrypts a disk using a customer-supplied encryption key. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.disk_encryption_key.new](#fn-diskdisk_encryption_keynew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source\nimage. Required if the source image is protected by a\ncustomer-supplied encryption key.\n\nInstance templates do not store customer-supplied\nencryption keys, so you cannot create disks for\ninstances in a managed instance group if the source\nimages are encrypted with your own keys. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.source_image_encryption_key.new](#fn-disksource_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.source_snapshot_encryption_key.new](#fn-disksource_snapshot_encryption_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `disk` sub block.\n', args=[]),
     new(
       auto_delete=null,
       boot=null,
@@ -44,6 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels=null,
       mode=null,
       provisioned_iops=null,
+      resource_manager_tags=null,
       resource_policies=null,
       source=null,
       source_image=null,
@@ -63,6 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels: labels,
       mode: mode,
       provisioned_iops: provisioned_iops,
+      resource_manager_tags: resource_manager_tags,
       resource_policies: resource_policies,
       source: source,
       source_image: source_image,
@@ -168,7 +170,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance_template.new` injects a new `google_compute_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_template` using the reference:\n\n    $._ref.google_compute_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance_template.new` injects a new `google_compute_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_template` using the reference:\n\n    $._ref.google_compute_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags.\n\t\t\t\tResource manager tag keys and values have the same definition as resource manager tags.\n\t\t\t\tKeys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456.\n\t\t\t\tThe field is ignored (both PUT \u0026amp; PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     machine_type,
@@ -190,6 +192,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     reservation_affinity=null,
+    resource_manager_tags=null,
     resource_policies=null,
     scheduling=null,
     service_account=null,
@@ -220,6 +223,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       region=region,
       reservation_affinity=reservation_affinity,
+      resource_manager_tags=resource_manager_tags,
       resource_policies=resource_policies,
       scheduling=scheduling,
       service_account=service_account,
@@ -229,7 +233,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_template`\nTerraform resource.\n\nUnlike [google.compute_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_template`\nTerraform resource.\n\nUnlike [google.compute_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags.\n\t\t\t\tResource manager tag keys and values have the same definition as resource manager tags.\n\t\t\t\tKeys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456.\n\t\t\t\tThe field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     machine_type,
     advanced_machine_features=null,
@@ -250,6 +254,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     reservation_affinity=null,
+    resource_manager_tags=null,
     resource_policies=null,
     scheduling=null,
     service_account=null,
@@ -276,6 +281,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     region: region,
     reservation_affinity: reservation_affinity,
+    resource_manager_tags: resource_manager_tags,
     resource_policies: resource_policies,
     scheduling: scheduling,
     service_account: service_account,
@@ -639,6 +645,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withResourceManagerTags':: d.fn(help='`google.obj.withResourceManagerTags` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the resource_manager_tags field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `resource_manager_tags` field.\n', args=[]),
+  withResourceManagerTags(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_template+: {
+        [resourceLabel]+: {
+          resource_manager_tags: value,
+        },
+      },
+    },
+  },
   '#withResourcePolicies':: d.fn(help='`google.list.withResourcePolicies` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the resource_policies field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `resource_policies` field.\n', args=[]),
   withResourcePolicies(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_interconnect_attachment.libsonnet b/4.x/_gen/resources/compute_interconnect_attachment.libsonnet
index 16655d26..a09fe5c3 100644
--- a/4.x/_gen/resources/compute_interconnect_attachment.libsonnet
+++ b/4.x/_gen/resources/compute_interconnect_attachment.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_interconnect_attachment', url='', help='`compute_interconnect_attachment` represents the `google_compute_interconnect_attachment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_interconnect_attachment.new` injects a new `google_compute_interconnect_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_interconnect_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_interconnect_attachment` using the reference:\n\n    $._ref.google_compute_interconnect_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_interconnect_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin_enabled` (`bool`): Whether the VLAN attachment is enabled or disabled.  When using\nPARTNER type this will Pre-Activate the interconnect attachment When `null`, the `admin_enabled` field will be omitted from the resulting object.\n  - `bandwidth` (`string`): Provisioned bandwidth capacity for the interconnect attachment.\nFor attachments of type DEDICATED, the user can set the bandwidth.\nFor attachments of type PARTNER, the Google Partner that is operating the interconnect must set the bandwidth.\nOutput only for PARTNER type, mutable for PARTNER_PROVIDER and DEDICATED,\nDefaults to BPS_10G Possible values: [\u0026#34;BPS_50M\u0026#34;, \u0026#34;BPS_100M\u0026#34;, \u0026#34;BPS_200M\u0026#34;, \u0026#34;BPS_300M\u0026#34;, \u0026#34;BPS_400M\u0026#34;, \u0026#34;BPS_500M\u0026#34;, \u0026#34;BPS_1G\u0026#34;, \u0026#34;BPS_2G\u0026#34;, \u0026#34;BPS_5G\u0026#34;, \u0026#34;BPS_10G\u0026#34;, \u0026#34;BPS_20G\u0026#34;, \u0026#34;BPS_50G\u0026#34;] When `null`, the `bandwidth` field will be omitted from the resulting object.\n  - `candidate_subnets` (`list`): Up to 16 candidate prefixes that can be used to restrict the allocation\nof cloudRouterIpAddress and customerRouterIpAddress for this attachment.\nAll prefixes must be within link-local address space (169.254.0.0/16)\nand must be /29 or shorter (/28, /27, etc). Google will attempt to select\nan unused /29 from the supplied candidate prefix(es). The request will\nfail if all possible /29s are in use on Google\u0026#39;s edge. If not supplied,\nGoogle will randomly select an unused /29 from all of link-local space. When `null`, the `candidate_subnets` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_availability_domain` (`string`): Desired availability domain for the attachment. Only available for type\nPARTNER, at creation time. For improved reliability, customers should\nconfigure a pair of attachments with one per availability domain. The\nselected availability domain will be provided to the Partner via the\npairing key so that the provisioned circuit will lie in the specified\ndomain. If not specified, the value will default to AVAILABILITY_DOMAIN_ANY. When `null`, the `edge_availability_domain` field will be omitted from the resulting object.\n  - `encryption` (`string`): Indicates the user-supplied encryption option of this interconnect\nattachment. Can only be specified at attachment creation for PARTNER or\nDEDICATED attachments.\n\n* NONE - This is the default value, which means that the VLAN attachment\ncarries unencrypted traffic. VMs are able to send traffic to, or receive\ntraffic from, such a VLAN attachment.\n\n* IPSEC - The VLAN attachment carries only encrypted traffic that is\nencrypted by an IPsec device, such as an HA VPN gateway or third-party\nIPsec VPN. VMs cannot directly send traffic to, or receive traffic from,\nsuch a VLAN attachment. To use HA VPN over Cloud Interconnect, the VLAN\nattachment must be created with this option. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;IPSEC\u0026#34;] When `null`, the `encryption` field will be omitted from the resulting object.\n  - `interconnect` (`string`): URL of the underlying Interconnect object that this attachment\u0026#39;s\ntraffic will traverse through. Required if type is DEDICATED, must not\nbe set if type is PARTNER. When `null`, the `interconnect` field will be omitted from the resulting object.\n  - `ipsec_internal_addresses` (`list`): URL of addresses that have been reserved for the interconnect attachment,\nUsed only for interconnect attachment that has the encryption option as\nIPSEC.\n\nThe addresses must be RFC 1918 IP address ranges. When creating HA VPN\ngateway over the interconnect attachment, if the attachment is configured\nto use an RFC 1918 IP address, then the VPN gateway\u0026#39;s IP address will be\nallocated from the IP address range specified here.\n\nFor example, if the HA VPN gateway\u0026#39;s interface 0 is paired to this\ninterconnect attachment, then an RFC 1918 IP address for the VPN gateway\ninterface 0 will be allocated from the IP address specified for this\ninterconnect attachment.\n\nIf this field is not specified for interconnect attachment that has\nencryption option as IPSEC, later on when creating HA VPN gateway on this\ninterconnect attachment, the HA VPN gateway\u0026#39;s IP address will be\nallocated from regional external IP address pool. When `null`, the `ipsec_internal_addresses` field will be omitted from the resulting object.\n  - `mtu` (`string`): Maximum Transmission Unit (MTU), in bytes, of packets passing through\nthis interconnect attachment. Currently, only 1440 and 1500 are allowed. If not specified, the value will default to 1440. When `null`, the `mtu` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is created. The\nname must be 1-63 characters long, and comply with RFC1035. Specifically, the\nname must be 1-63 characters long and match the regular expression\n\u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first character must be a\nlowercase letter, and all following characters must be a dash, lowercase\nletter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the regional interconnect attachment resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): URL of the cloud router to be used for dynamic routing. This router must be in\nthe same region as this InterconnectAttachment. The InterconnectAttachment will\nautomatically connect the Interconnect to the network \u0026amp; region within which the\nCloud Router is configured.\n  - `type` (`string`): The type of InterconnectAttachment you wish to create. Defaults to\nDEDICATED. Possible values: [\u0026#34;DEDICATED\u0026#34;, \u0026#34;PARTNER\u0026#34;, \u0026#34;PARTNER_PROVIDER\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `vlan_tag8021q` (`number`): The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. When\nusing PARTNER type this will be managed upstream. When `null`, the `vlan_tag8021q` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_interconnect_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_interconnect_attachment.new` injects a new `google_compute_interconnect_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_interconnect_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_interconnect_attachment` using the reference:\n\n    $._ref.google_compute_interconnect_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_interconnect_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin_enabled` (`bool`): Whether the VLAN attachment is enabled or disabled.  When using\nPARTNER type this will Pre-Activate the interconnect attachment When `null`, the `admin_enabled` field will be omitted from the resulting object.\n  - `bandwidth` (`string`): Provisioned bandwidth capacity for the interconnect attachment.\nFor attachments of type DEDICATED, the user can set the bandwidth.\nFor attachments of type PARTNER, the Google Partner that is operating the interconnect must set the bandwidth.\nOutput only for PARTNER type, mutable for PARTNER_PROVIDER and DEDICATED,\nDefaults to BPS_10G Possible values: [\u0026#34;BPS_50M\u0026#34;, \u0026#34;BPS_100M\u0026#34;, \u0026#34;BPS_200M\u0026#34;, \u0026#34;BPS_300M\u0026#34;, \u0026#34;BPS_400M\u0026#34;, \u0026#34;BPS_500M\u0026#34;, \u0026#34;BPS_1G\u0026#34;, \u0026#34;BPS_2G\u0026#34;, \u0026#34;BPS_5G\u0026#34;, \u0026#34;BPS_10G\u0026#34;, \u0026#34;BPS_20G\u0026#34;, \u0026#34;BPS_50G\u0026#34;] When `null`, the `bandwidth` field will be omitted from the resulting object.\n  - `candidate_subnets` (`list`): Up to 16 candidate prefixes that can be used to restrict the allocation\nof cloudRouterIpAddress and customerRouterIpAddress for this attachment.\nAll prefixes must be within link-local address space (169.254.0.0/16)\nand must be /29 or shorter (/28, /27, etc). Google will attempt to select\nan unused /29 from the supplied candidate prefix(es). The request will\nfail if all possible /29s are in use on Google\u0026#39;s edge. If not supplied,\nGoogle will randomly select an unused /29 from all of link-local space. When `null`, the `candidate_subnets` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_availability_domain` (`string`): Desired availability domain for the attachment. Only available for type\nPARTNER, at creation time. For improved reliability, customers should\nconfigure a pair of attachments with one per availability domain. The\nselected availability domain will be provided to the Partner via the\npairing key so that the provisioned circuit will lie in the specified\ndomain. If not specified, the value will default to AVAILABILITY_DOMAIN_ANY. When `null`, the `edge_availability_domain` field will be omitted from the resulting object.\n  - `encryption` (`string`): Indicates the user-supplied encryption option of this interconnect\nattachment. Can only be specified at attachment creation for PARTNER or\nDEDICATED attachments.\n\n* NONE - This is the default value, which means that the VLAN attachment\ncarries unencrypted traffic. VMs are able to send traffic to, or receive\ntraffic from, such a VLAN attachment.\n\n* IPSEC - The VLAN attachment carries only encrypted traffic that is\nencrypted by an IPsec device, such as an HA VPN gateway or third-party\nIPsec VPN. VMs cannot directly send traffic to, or receive traffic from,\nsuch a VLAN attachment. To use HA VPN over Cloud Interconnect, the VLAN\nattachment must be created with this option. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;IPSEC\u0026#34;] When `null`, the `encryption` field will be omitted from the resulting object.\n  - `interconnect` (`string`): URL of the underlying Interconnect object that this attachment\u0026#39;s\ntraffic will traverse through. Required if type is DEDICATED, must not\nbe set if type is PARTNER. When `null`, the `interconnect` field will be omitted from the resulting object.\n  - `ipsec_internal_addresses` (`list`): URL of addresses that have been reserved for the interconnect attachment,\nUsed only for interconnect attachment that has the encryption option as\nIPSEC.\n\nThe addresses must be RFC 1918 IP address ranges. When creating HA VPN\ngateway over the interconnect attachment, if the attachment is configured\nto use an RFC 1918 IP address, then the VPN gateway\u0026#39;s IP address will be\nallocated from the IP address range specified here.\n\nFor example, if the HA VPN gateway\u0026#39;s interface 0 is paired to this\ninterconnect attachment, then an RFC 1918 IP address for the VPN gateway\ninterface 0 will be allocated from the IP address specified for this\ninterconnect attachment.\n\nIf this field is not specified for interconnect attachment that has\nencryption option as IPSEC, later on when creating HA VPN gateway on this\ninterconnect attachment, the HA VPN gateway\u0026#39;s IP address will be\nallocated from regional external IP address pool. When `null`, the `ipsec_internal_addresses` field will be omitted from the resulting object.\n  - `mtu` (`string`): Maximum Transmission Unit (MTU), in bytes, of packets passing through\nthis interconnect attachment. Currently, only 1440 and 1500 are allowed. If not specified, the value will default to 1440. When `null`, the `mtu` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is created. The\nname must be 1-63 characters long, and comply with RFC1035. Specifically, the\nname must be 1-63 characters long and match the regular expression\n\u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first character must be a\nlowercase letter, and all following characters must be a dash, lowercase\nletter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the regional interconnect attachment resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): URL of the cloud router to be used for dynamic routing. This router must be in\nthe same region as this InterconnectAttachment. The InterconnectAttachment will\nautomatically connect the Interconnect to the network \u0026amp; region within which the\nCloud Router is configured.\n  - `stack_type` (`string`): The stack type for this interconnect attachment to identify whether the IPv6\nfeature is enabled or not. If not specified, IPV4_ONLY will be used.\n\nThis field can be both set at interconnect attachments creation and update\ninterconnect attachment operations. Possible values: [\u0026#34;IPV4_IPV6\u0026#34;, \u0026#34;IPV4_ONLY\u0026#34;] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `type` (`string`): The type of InterconnectAttachment you wish to create. Defaults to\nDEDICATED. Possible values: [\u0026#34;DEDICATED\u0026#34;, \u0026#34;PARTNER\u0026#34;, \u0026#34;PARTNER_PROVIDER\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `vlan_tag8021q` (`number`): The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. When\nusing PARTNER type this will be managed upstream. When `null`, the `vlan_tag8021q` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_interconnect_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -18,6 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     mtu=null,
     project=null,
     region=null,
+    stack_type=null,
     timeouts=null,
     type=null,
     vlan_tag8021q=null,
@@ -39,13 +40,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       region=region,
       router=router,
+      stack_type=stack_type,
       timeouts=timeouts,
       type=type,
       vlan_tag8021q=vlan_tag8021q
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_interconnect_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `compute_interconnect_attachment`\nTerraform resource.\n\nUnlike [google.compute_interconnect_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin_enabled` (`bool`): Whether the VLAN attachment is enabled or disabled.  When using\nPARTNER type this will Pre-Activate the interconnect attachment When `null`, the `admin_enabled` field will be omitted from the resulting object.\n  - `bandwidth` (`string`): Provisioned bandwidth capacity for the interconnect attachment.\nFor attachments of type DEDICATED, the user can set the bandwidth.\nFor attachments of type PARTNER, the Google Partner that is operating the interconnect must set the bandwidth.\nOutput only for PARTNER type, mutable for PARTNER_PROVIDER and DEDICATED,\nDefaults to BPS_10G Possible values: ["BPS_50M", "BPS_100M", "BPS_200M", "BPS_300M", "BPS_400M", "BPS_500M", "BPS_1G", "BPS_2G", "BPS_5G", "BPS_10G", "BPS_20G", "BPS_50G"] When `null`, the `bandwidth` field will be omitted from the resulting object.\n  - `candidate_subnets` (`list`): Up to 16 candidate prefixes that can be used to restrict the allocation\nof cloudRouterIpAddress and customerRouterIpAddress for this attachment.\nAll prefixes must be within link-local address space (169.254.0.0/16)\nand must be /29 or shorter (/28, /27, etc). Google will attempt to select\nan unused /29 from the supplied candidate prefix(es). The request will\nfail if all possible /29s are in use on Google's edge. If not supplied,\nGoogle will randomly select an unused /29 from all of link-local space. When `null`, the `candidate_subnets` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_availability_domain` (`string`): Desired availability domain for the attachment. Only available for type\nPARTNER, at creation time. For improved reliability, customers should\nconfigure a pair of attachments with one per availability domain. The\nselected availability domain will be provided to the Partner via the\npairing key so that the provisioned circuit will lie in the specified\ndomain. If not specified, the value will default to AVAILABILITY_DOMAIN_ANY. When `null`, the `edge_availability_domain` field will be omitted from the resulting object.\n  - `encryption` (`string`): Indicates the user-supplied encryption option of this interconnect\nattachment. Can only be specified at attachment creation for PARTNER or\nDEDICATED attachments.\n\n* NONE - This is the default value, which means that the VLAN attachment\ncarries unencrypted traffic. VMs are able to send traffic to, or receive\ntraffic from, such a VLAN attachment.\n\n* IPSEC - The VLAN attachment carries only encrypted traffic that is\nencrypted by an IPsec device, such as an HA VPN gateway or third-party\nIPsec VPN. VMs cannot directly send traffic to, or receive traffic from,\nsuch a VLAN attachment. To use HA VPN over Cloud Interconnect, the VLAN\nattachment must be created with this option. Default value: "NONE" Possible values: ["NONE", "IPSEC"] When `null`, the `encryption` field will be omitted from the resulting object.\n  - `interconnect` (`string`): URL of the underlying Interconnect object that this attachment's\ntraffic will traverse through. Required if type is DEDICATED, must not\nbe set if type is PARTNER. When `null`, the `interconnect` field will be omitted from the resulting object.\n  - `ipsec_internal_addresses` (`list`): URL of addresses that have been reserved for the interconnect attachment,\nUsed only for interconnect attachment that has the encryption option as\nIPSEC.\n\nThe addresses must be RFC 1918 IP address ranges. When creating HA VPN\ngateway over the interconnect attachment, if the attachment is configured\nto use an RFC 1918 IP address, then the VPN gateway's IP address will be\nallocated from the IP address range specified here.\n\nFor example, if the HA VPN gateway's interface 0 is paired to this\ninterconnect attachment, then an RFC 1918 IP address for the VPN gateway\ninterface 0 will be allocated from the IP address specified for this\ninterconnect attachment.\n\nIf this field is not specified for interconnect attachment that has\nencryption option as IPSEC, later on when creating HA VPN gateway on this\ninterconnect attachment, the HA VPN gateway's IP address will be\nallocated from regional external IP address pool. When `null`, the `ipsec_internal_addresses` field will be omitted from the resulting object.\n  - `mtu` (`string`): Maximum Transmission Unit (MTU), in bytes, of packets passing through\nthis interconnect attachment. Currently, only 1440 and 1500 are allowed. If not specified, the value will default to 1440. When `null`, the `mtu` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is created. The\nname must be 1-63 characters long, and comply with RFC1035. Specifically, the\nname must be 1-63 characters long and match the regular expression\n'[a-z]([-a-z0-9]*[a-z0-9])?' which means the first character must be a\nlowercase letter, and all following characters must be a dash, lowercase\nletter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the regional interconnect attachment resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): URL of the cloud router to be used for dynamic routing. This router must be in\nthe same region as this InterconnectAttachment. The InterconnectAttachment will\nautomatically connect the Interconnect to the network & region within which the\nCloud Router is configured.\n  - `type` (`string`): The type of InterconnectAttachment you wish to create. Defaults to\nDEDICATED. Possible values: ["DEDICATED", "PARTNER", "PARTNER_PROVIDER"] When `null`, the `type` field will be omitted from the resulting object.\n  - `vlan_tag8021q` (`number`): The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. When\nusing PARTNER type this will be managed upstream. When `null`, the `vlan_tag8021q` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_interconnect_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_interconnect_attachment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_interconnect_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `compute_interconnect_attachment`\nTerraform resource.\n\nUnlike [google.compute_interconnect_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin_enabled` (`bool`): Whether the VLAN attachment is enabled or disabled.  When using\nPARTNER type this will Pre-Activate the interconnect attachment When `null`, the `admin_enabled` field will be omitted from the resulting object.\n  - `bandwidth` (`string`): Provisioned bandwidth capacity for the interconnect attachment.\nFor attachments of type DEDICATED, the user can set the bandwidth.\nFor attachments of type PARTNER, the Google Partner that is operating the interconnect must set the bandwidth.\nOutput only for PARTNER type, mutable for PARTNER_PROVIDER and DEDICATED,\nDefaults to BPS_10G Possible values: ["BPS_50M", "BPS_100M", "BPS_200M", "BPS_300M", "BPS_400M", "BPS_500M", "BPS_1G", "BPS_2G", "BPS_5G", "BPS_10G", "BPS_20G", "BPS_50G"] When `null`, the `bandwidth` field will be omitted from the resulting object.\n  - `candidate_subnets` (`list`): Up to 16 candidate prefixes that can be used to restrict the allocation\nof cloudRouterIpAddress and customerRouterIpAddress for this attachment.\nAll prefixes must be within link-local address space (169.254.0.0/16)\nand must be /29 or shorter (/28, /27, etc). Google will attempt to select\nan unused /29 from the supplied candidate prefix(es). The request will\nfail if all possible /29s are in use on Google's edge. If not supplied,\nGoogle will randomly select an unused /29 from all of link-local space. When `null`, the `candidate_subnets` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_availability_domain` (`string`): Desired availability domain for the attachment. Only available for type\nPARTNER, at creation time. For improved reliability, customers should\nconfigure a pair of attachments with one per availability domain. The\nselected availability domain will be provided to the Partner via the\npairing key so that the provisioned circuit will lie in the specified\ndomain. If not specified, the value will default to AVAILABILITY_DOMAIN_ANY. When `null`, the `edge_availability_domain` field will be omitted from the resulting object.\n  - `encryption` (`string`): Indicates the user-supplied encryption option of this interconnect\nattachment. Can only be specified at attachment creation for PARTNER or\nDEDICATED attachments.\n\n* NONE - This is the default value, which means that the VLAN attachment\ncarries unencrypted traffic. VMs are able to send traffic to, or receive\ntraffic from, such a VLAN attachment.\n\n* IPSEC - The VLAN attachment carries only encrypted traffic that is\nencrypted by an IPsec device, such as an HA VPN gateway or third-party\nIPsec VPN. VMs cannot directly send traffic to, or receive traffic from,\nsuch a VLAN attachment. To use HA VPN over Cloud Interconnect, the VLAN\nattachment must be created with this option. Default value: "NONE" Possible values: ["NONE", "IPSEC"] When `null`, the `encryption` field will be omitted from the resulting object.\n  - `interconnect` (`string`): URL of the underlying Interconnect object that this attachment's\ntraffic will traverse through. Required if type is DEDICATED, must not\nbe set if type is PARTNER. When `null`, the `interconnect` field will be omitted from the resulting object.\n  - `ipsec_internal_addresses` (`list`): URL of addresses that have been reserved for the interconnect attachment,\nUsed only for interconnect attachment that has the encryption option as\nIPSEC.\n\nThe addresses must be RFC 1918 IP address ranges. When creating HA VPN\ngateway over the interconnect attachment, if the attachment is configured\nto use an RFC 1918 IP address, then the VPN gateway's IP address will be\nallocated from the IP address range specified here.\n\nFor example, if the HA VPN gateway's interface 0 is paired to this\ninterconnect attachment, then an RFC 1918 IP address for the VPN gateway\ninterface 0 will be allocated from the IP address specified for this\ninterconnect attachment.\n\nIf this field is not specified for interconnect attachment that has\nencryption option as IPSEC, later on when creating HA VPN gateway on this\ninterconnect attachment, the HA VPN gateway's IP address will be\nallocated from regional external IP address pool. When `null`, the `ipsec_internal_addresses` field will be omitted from the resulting object.\n  - `mtu` (`string`): Maximum Transmission Unit (MTU), in bytes, of packets passing through\nthis interconnect attachment. Currently, only 1440 and 1500 are allowed. If not specified, the value will default to 1440. When `null`, the `mtu` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is created. The\nname must be 1-63 characters long, and comply with RFC1035. Specifically, the\nname must be 1-63 characters long and match the regular expression\n'[a-z]([-a-z0-9]*[a-z0-9])?' which means the first character must be a\nlowercase letter, and all following characters must be a dash, lowercase\nletter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the regional interconnect attachment resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): URL of the cloud router to be used for dynamic routing. This router must be in\nthe same region as this InterconnectAttachment. The InterconnectAttachment will\nautomatically connect the Interconnect to the network & region within which the\nCloud Router is configured.\n  - `stack_type` (`string`): The stack type for this interconnect attachment to identify whether the IPv6\nfeature is enabled or not. If not specified, IPV4_ONLY will be used.\n\nThis field can be both set at interconnect attachments creation and update\ninterconnect attachment operations. Possible values: ["IPV4_IPV6", "IPV4_ONLY"] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `type` (`string`): The type of InterconnectAttachment you wish to create. Defaults to\nDEDICATED. Possible values: ["DEDICATED", "PARTNER", "PARTNER_PROVIDER"] When `null`, the `type` field will be omitted from the resulting object.\n  - `vlan_tag8021q` (`number`): The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. When\nusing PARTNER type this will be managed upstream. When `null`, the `vlan_tag8021q` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_interconnect_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_interconnect_attachment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     router,
@@ -60,6 +62,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     mtu=null,
     project=null,
     region=null,
+    stack_type=null,
     timeouts=null,
     type=null,
     vlan_tag8021q=null
@@ -77,6 +80,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     region: region,
     router: router,
+    stack_type: stack_type,
     timeouts: timeouts,
     type: type,
     vlan_tag8021q: vlan_tag8021q,
@@ -223,6 +227,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStackType':: d.fn(help='`google.string.withStackType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the stack_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `stack_type` field.\n', args=[]),
+  withStackType(resourceLabel, value): {
+    resource+: {
+      google_compute_interconnect_attachment+: {
+        [resourceLabel]+: {
+          stack_type: value,
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_network_endpoint_group.libsonnet b/4.x/_gen/resources/compute_network_endpoint_group.libsonnet
index 588c3e8f..d793f55d 100644
--- a/4.x/_gen/resources/compute_network_endpoint_group.libsonnet
+++ b/4.x/_gen/resources/compute_network_endpoint_group.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_network_endpoint_group', url='', help='`compute_network_endpoint_group` represents the `google_compute_network_endpoint_group` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_network_endpoint_group.new` injects a new `google_compute_network_endpoint_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_network_endpoint_group` using the reference:\n\n    $._ref.google_compute_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses \u0026#34;default\u0026#34; project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: \u0026#34;GCE_VM_IP_PORT\u0026#34; Possible values: [\u0026#34;GCE_VM_IP\u0026#34;, \u0026#34;GCE_VM_IP_PORT\u0026#34;, \u0026#34;NON_GCP_PRIVATE_IP_PORT\u0026#34;] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_network_endpoint_group.new` injects a new `google_compute_network_endpoint_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_network_endpoint_group` using the reference:\n\n    $._ref.google_compute_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses \u0026#34;default\u0026#34; project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: \u0026#34;GCE_VM_IP_PORT\u0026#34; Possible values: [\u0026#34;GCE_VM_IP\u0026#34;, \u0026#34;GCE_VM_IP_PORT\u0026#34;, \u0026#34;NON_GCP_PRIVATE_IP_PORT\u0026#34;, \u0026#34;INTERNET_IP_PORT\u0026#34;, \u0026#34;INTERNET_FQDN_PORT\u0026#34;, \u0026#34;SERVERLESS\u0026#34;, \u0026#34;PRIVATE_SERVICE_CONNECT\u0026#34;] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_network_endpoint_group`\nTerraform resource.\n\nUnlike [google.compute_network_endpoint_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses "default" project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_network_endpoint_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_network_endpoint_group`\nTerraform resource.\n\nUnlike [google.compute_network_endpoint_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses "default" project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT", "SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_network_endpoint_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     network,
diff --git a/4.x/_gen/resources/compute_network_firewall_policy.libsonnet b/4.x/_gen/resources/compute_network_firewall_policy.libsonnet
index d9863614..288a7324 100644
--- a/4.x/_gen/resources/compute_network_firewall_policy.libsonnet
+++ b/4.x/_gen/resources/compute_network_firewall_policy.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_network_firewall_policy', url='', help='`compute_network_firewall_policy` represents the `google_compute_network_firewall_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_network_firewall_policy.new` injects a new `google_compute_network_firewall_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_network_firewall_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_network_firewall_policy` using the reference:\n\n    $._ref.google_compute_network_firewall_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_network_firewall_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_network_firewall_policy.new` injects a new `google_compute_network_firewall_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_network_firewall_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_network_firewall_policy` using the reference:\n\n    $._ref.google_compute_network_firewall_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_network_firewall_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -21,7 +21,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_network_firewall_policy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_network_firewall_policy`\nTerraform resource.\n\nUnlike [google.compute_network_firewall_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_network_firewall_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_network_firewall_policy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_network_firewall_policy`\nTerraform resource.\n\nUnlike [google.compute_network_firewall_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_network_firewall_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/compute_node_group.libsonnet b/4.x/_gen/resources/compute_node_group.libsonnet
index b6c0d95b..ae37c5ee 100644
--- a/4.x/_gen/resources/compute_node_group.libsonnet
+++ b/4.x/_gen/resources/compute_node_group.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       start_time: start_time,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_node_group.new` injects a new `google_compute_node_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_node_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_node_group` using the reference:\n\n    $._ref.google_compute_node_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_node_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of \u0026#39;initial_size\u0026#39; or \u0026#39;size\u0026#39; must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `size` (`number`): The total number of nodes in the node group. One of \u0026#39;initial_size\u0026#39; or \u0026#39;size\u0026#39; must be specified. When `null`, the `size` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_node_group.new` injects a new `google_compute_node_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_node_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_node_group` using the reference:\n\n    $._ref.google_compute_node_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_node_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of \u0026#39;initial_size\u0026#39; or \u0026#39;autoscaling_policy\u0026#39; must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups.\n\nOne of \u0026#39;initial_size\u0026#39; or \u0026#39;autoscaling_policy\u0026#39; must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     node_template,
@@ -34,7 +34,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name=null,
     project=null,
     share_settings=null,
-    size=null,
     timeouts=null,
     zone=null,
     _meta={}
@@ -51,13 +50,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       node_template=node_template,
       project=project,
       share_settings=share_settings,
-      size=size,
       timeouts=timeouts,
       zone=zone
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_node_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_node_group`\nTerraform resource.\n\nUnlike [google.compute_node_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `size` (`number`): The total number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `size` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_node_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_node_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_node_group`\nTerraform resource.\n\nUnlike [google.compute_node_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups.\n\nOne of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_node_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     node_template,
     autoscaling_policy=null,
@@ -68,7 +66,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name=null,
     project=null,
     share_settings=null,
-    size=null,
     timeouts=null,
     zone=null
   ):: std.prune(a={
@@ -81,7 +78,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_template: node_template,
     project: project,
     share_settings: share_settings,
-    size: size,
     timeouts: timeouts,
     zone: zone,
   }),
@@ -235,16 +231,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#withSize':: d.fn(help='`google.number.withSize` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the size field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `size` field.\n', args=[]),
-  withSize(resourceLabel, value): {
-    resource+: {
-      google_compute_node_group+: {
-        [resourceLabel]+: {
-          size: value,
-        },
-      },
-    },
-  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_per_instance_config.libsonnet b/4.x/_gen/resources/compute_per_instance_config.libsonnet
index fa0eb867..c5438dcf 100644
--- a/4.x/_gen/resources/compute_per_instance_config.libsonnet
+++ b/4.x/_gen/resources/compute_per_instance_config.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_per_instance_config', url='', help='`compute_per_instance_config` represents the `google_compute_per_instance_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_per_instance_config.new` injects a new `google_compute_per_instance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_per_instance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_per_instance_config` using the reference:\n\n    $._ref.google_compute_per_instance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_per_instance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `instance_group_manager` (`string`): The instance group manager this instance config is part of.\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is \u0026#39;NONE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is \u0026#39;REPLACE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the containing instance group manager is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_per_instance_config.new` injects a new `google_compute_per_instance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_per_instance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_per_instance_config` using the reference:\n\n    $._ref.google_compute_per_instance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_per_instance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `instance_group_manager` (`string`): The instance group manager this instance config is part of.\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is \u0026#39;NONE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is \u0026#39;REPLACE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.\nWhen false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the containing instance group manager is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     instance_group_manager,
@@ -11,6 +11,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     most_disruptive_allowed_action=null,
     preserved_state=null,
     project=null,
+    remove_instance_on_destroy=null,
     remove_instance_state_on_destroy=null,
     timeouts=null,
     zone=null,
@@ -25,13 +26,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name=name,
       preserved_state=preserved_state,
       project=project,
+      remove_instance_on_destroy=remove_instance_on_destroy,
       remove_instance_state_on_destroy=remove_instance_state_on_destroy,
       timeouts=timeouts,
       zone=zone
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_per_instance_config.newAttrs` constructs a new object with attributes and blocks configured for the `compute_per_instance_config`\nTerraform resource.\n\nUnlike [google.compute_per_instance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_group_manager` (`string`): The instance group manager this instance config is part of.\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is 'NONE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is 'REPLACE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the containing instance group manager is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_per_instance_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_per_instance_config.newAttrs` constructs a new object with attributes and blocks configured for the `compute_per_instance_config`\nTerraform resource.\n\nUnlike [google.compute_per_instance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_group_manager` (`string`): The instance group manager this instance config is part of.\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is 'NONE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is 'REPLACE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.\nWhen false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the containing instance group manager is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_per_instance_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     instance_group_manager,
     name,
@@ -39,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     most_disruptive_allowed_action=null,
     preserved_state=null,
     project=null,
+    remove_instance_on_destroy=null,
     remove_instance_state_on_destroy=null,
     timeouts=null,
     zone=null
@@ -49,6 +52,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name: name,
     preserved_state: preserved_state,
     project: project,
+    remove_instance_on_destroy: remove_instance_on_destroy,
     remove_instance_state_on_destroy: remove_instance_state_on_destroy,
     timeouts: timeouts,
     zone: zone,
@@ -68,12 +72,56 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         source: source,
       }),
     },
-    '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
+    external_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `external_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    internal_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `internal_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.\n  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
     new(
       disk=null,
+      external_ip=null,
+      internal_ip=null,
       metadata=null
     ):: std.prune(a={
       disk: disk,
+      external_ip: external_ip,
+      internal_ip: internal_ip,
       metadata: metadata,
     }),
   },
@@ -159,6 +207,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRemoveInstanceOnDestroy':: d.fn(help='`google.bool.withRemoveInstanceOnDestroy` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the remove_instance_on_destroy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `remove_instance_on_destroy` field.\n', args=[]),
+  withRemoveInstanceOnDestroy(resourceLabel, value): {
+    resource+: {
+      google_compute_per_instance_config+: {
+        [resourceLabel]+: {
+          remove_instance_on_destroy: value,
+        },
+      },
+    },
+  },
   '#withRemoveInstanceStateOnDestroy':: d.fn(help='`google.bool.withRemoveInstanceStateOnDestroy` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the remove_instance_state_on_destroy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `remove_instance_state_on_destroy` field.\n', args=[]),
   withRemoveInstanceStateOnDestroy(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_region_disk.libsonnet b/4.x/_gen/resources/compute_region_disk.libsonnet
index 22275681..696239ff 100644
--- a/4.x/_gen/resources/compute_region_disk.libsonnet
+++ b/4.x/_gen/resources/compute_region_disk.libsonnet
@@ -28,7 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_disk.new` injects a new `google_compute_region_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_disk` using the reference:\n\n    $._ref.google_compute_region_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_disk.new` injects a new `google_compute_region_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_disk` using the reference:\n\n    $._ref.google_compute_region_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -73,7 +73,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_disk`\nTerraform resource.\n\nUnlike [google.compute_region_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_disk` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_disk`\nTerraform resource.\n\nUnlike [google.compute_region_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_disk` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     replica_zones,
diff --git a/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet b/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet
index 68f3d34a..fa17558a 100644
--- a/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet
+++ b/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet
@@ -30,7 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       port: port,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_instance_group_manager.new` injects a new `google_compute_region_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_group_manager` using the reference:\n\n    $._ref.google_compute_region_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_instance_group_manager.new` injects a new `google_compute_region_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_group_manager` using the reference:\n\n    $._ref.google_compute_region_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     base_instance_name,
@@ -45,6 +45,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -69,6 +71,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       region=region,
       stateful_disk=stateful_disk,
+      stateful_external_ip=stateful_external_ip,
+      stateful_internal_ip=stateful_internal_ip,
       target_pools=target_pools,
       target_size=target_size,
       timeouts=timeouts,
@@ -79,7 +83,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_region_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_region_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     base_instance_name,
     name,
@@ -93,6 +97,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -113,6 +119,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     region: region,
     stateful_disk: stateful_disk,
+    stateful_external_ip: stateful_external_ip,
+    stateful_internal_ip: stateful_internal_ip,
     target_pools: target_pools,
     target_size: target_size,
     timeouts: timeouts,
@@ -131,6 +139,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       device_name: device_name,
     }),
   },
+  stateful_external_ip:: {
+    '#new':: d.fn(help='\n`google.compute_region_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_external_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
+  stateful_internal_ip:: {
+    '#new':: d.fn(help='\n`google.compute_region_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_internal_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.compute_region_instance_group_manager.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -349,6 +377,46 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStatefulExternalIp':: d.fn(help='`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulExternalIpMixin':: d.fn(help='`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIp':: d.fn(help='`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIpMixin':: d.fn(help='`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTargetPools':: d.fn(help='`google.list.withTargetPools` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the target_pools field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `target_pools` field.\n', args=[]),
   withTargetPools(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_region_instance_template.libsonnet b/4.x/_gen/resources/compute_region_instance_template.libsonnet
index 0cfcb904..20e089f4 100644
--- a/4.x/_gen/resources/compute_region_instance_template.libsonnet
+++ b/4.x/_gen/resources/compute_region_instance_template.libsonnet
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         kms_key_self_link: kms_key_self_link,
       }),
     },
-    '#new':: d.fn(help='\n`google.compute_region_instance_template.disk.new` constructs a new object with attributes and blocks configured for the `disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`bool`): Whether or not the disk should be auto-deleted. This defaults to true. When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `boot` (`bool`): Indicates that this is a boot disk. When `null`, the `boot` field will be omitted from the resulting object.\n  - `device_name` (`string`): A unique device name that is reflected into the /dev/ tree of a Linux operating system running within the instance. If not specified, the server chooses a default device name to apply to this disk. When `null`, the `device_name` field will be omitted from the resulting object.\n  - `disk_name` (`string`): Name of the disk. When not provided, this defaults to the name of the instance. When `null`, the `disk_name` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): The size of the image in gigabytes. If not specified, it will inherit the size of its base image. For SCRATCH disks, the size must be one of 375 or 3000 GB, with a default of 375 GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): The Google Compute Engine disk type. Such as "pd-ssd", "local-ssd", "pd-balanced" or "pd-standard". When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `interface` (`string`): Specifies the disk interface to use for attaching this disk. When `null`, the `interface` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to disks, When `null`, the `labels` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If you are attaching or creating a boot disk, this must read-write mode. When `null`, the `mode` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk). When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list (short name or id) of resource policies to attach to this disk. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `source` (`string`): The name (not self_link) of the disk (such as those managed by google_compute_disk) to attach. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source` field will be omitted from the resulting object.\n  - `source_image` (`string`): The image from which to initialize this disk. This can be one of: the image's self_link, projects/{project}/global/images/{image}, projects/{project}/global/images/family/{family}, global/images/{image}, global/images/family/{family}, family/{family}, {project}/{family}, {project}/{image}, {family}, or {image}. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): The source snapshot to create this disk. When creating\na new instance, one of initializeParams.sourceSnapshot,\ninitializeParams.sourceImage, or disks.source is\nrequired except for local SSD. When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `type` (`string`): The type of Google Compute Engine disk, can be either "SCRATCH" or "PERSISTENT". When `null`, the `type` field will be omitted from the resulting object.\n  - `disk_encryption_key` (`list[obj]`): Encrypts or decrypts a disk using a customer-supplied encryption key. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.disk_encryption_key.new](#fn-diskdisk_encryption_keynew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source\nimage. Required if the source image is protected by a\ncustomer-supplied encryption key.\n\nInstance templates do not store customer-supplied\nencryption keys, so you cannot create disks for\ninstances in a managed instance group if the source\nimages are encrypted with your own keys. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.source_image_encryption_key.new](#fn-disksource_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.source_snapshot_encryption_key.new](#fn-disksource_snapshot_encryption_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `disk` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_region_instance_template.disk.new` constructs a new object with attributes and blocks configured for the `disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`bool`): Whether or not the disk should be auto-deleted. This defaults to true. When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `boot` (`bool`): Indicates that this is a boot disk. When `null`, the `boot` field will be omitted from the resulting object.\n  - `device_name` (`string`): A unique device name that is reflected into the /dev/ tree of a Linux operating system running within the instance. If not specified, the server chooses a default device name to apply to this disk. When `null`, the `device_name` field will be omitted from the resulting object.\n  - `disk_name` (`string`): Name of the disk. When not provided, this defaults to the name of the instance. When `null`, the `disk_name` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): The size of the image in gigabytes. If not specified, it will inherit the size of its base image. For SCRATCH disks, the size must be one of 375 or 3000 GB, with a default of 375 GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): The Google Compute Engine disk type. Such as "pd-ssd", "local-ssd", "pd-balanced" or "pd-standard". When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `interface` (`string`): Specifies the disk interface to use for attaching this disk. When `null`, the `interface` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to disks, When `null`, the `labels` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If you are attaching or creating a boot disk, this must read-write mode. When `null`, the `mode` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk). When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list (short name or id) of resource policies to attach to this disk. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `source` (`string`): The name (not self_link) of the disk (such as those managed by google_compute_disk) to attach. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source` field will be omitted from the resulting object.\n  - `source_image` (`string`): The image from which to initialize this disk. This can be one of: the image's self_link, projects/{project}/global/images/{image}, projects/{project}/global/images/family/{family}, global/images/{image}, global/images/family/{family}, family/{family}, {project}/{family}, {project}/{image}, {family}, or {image}. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): The source snapshot to create this disk. When creating\na new instance, one of initializeParams.sourceSnapshot,\ninitializeParams.sourceImage, or disks.source is\nrequired except for local SSD. When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `type` (`string`): The type of Google Compute Engine disk, can be either "SCRATCH" or "PERSISTENT". When `null`, the `type` field will be omitted from the resulting object.\n  - `disk_encryption_key` (`list[obj]`): Encrypts or decrypts a disk using a customer-supplied encryption key. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.disk_encryption_key.new](#fn-diskdisk_encryption_keynew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source\nimage. Required if the source image is protected by a\ncustomer-supplied encryption key.\n\nInstance templates do not store customer-supplied\nencryption keys, so you cannot create disks for\ninstances in a managed instance group if the source\nimages are encrypted with your own keys. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.source_image_encryption_key.new](#fn-disksource_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.source_snapshot_encryption_key.new](#fn-disksource_snapshot_encryption_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `disk` sub block.\n', args=[]),
     new(
       auto_delete=null,
       boot=null,
@@ -44,6 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels=null,
       mode=null,
       provisioned_iops=null,
+      resource_manager_tags=null,
       resource_policies=null,
       source=null,
       source_image=null,
@@ -63,6 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels: labels,
       mode: mode,
       provisioned_iops: provisioned_iops,
+      resource_manager_tags: resource_manager_tags,
       resource_policies: resource_policies,
       source: source,
       source_image: source_image,
@@ -168,7 +170,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_instance_template.new` injects a new `google_compute_region_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_template` using the reference:\n\n    $._ref.google_compute_region_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_instance_template.new` injects a new `google_compute_region_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_template` using the reference:\n\n    $._ref.google_compute_region_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags.\n\t\t\t\tResource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT \u0026amp; PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     machine_type,
@@ -190,6 +192,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     reservation_affinity=null,
+    resource_manager_tags=null,
     resource_policies=null,
     scheduling=null,
     service_account=null,
@@ -220,6 +223,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       region=region,
       reservation_affinity=reservation_affinity,
+      resource_manager_tags=resource_manager_tags,
       resource_policies=resource_policies,
       scheduling=scheduling,
       service_account=service_account,
@@ -229,7 +233,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_template`\nTerraform resource.\n\nUnlike [google.compute_region_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_template`\nTerraform resource.\n\nUnlike [google.compute_region_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_manager_tags` (`obj`): A map of resource manager tags.\n\t\t\t\tResource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     machine_type,
     advanced_machine_features=null,
@@ -250,6 +254,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     reservation_affinity=null,
+    resource_manager_tags=null,
     resource_policies=null,
     scheduling=null,
     service_account=null,
@@ -276,6 +281,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     region: region,
     reservation_affinity: reservation_affinity,
+    resource_manager_tags: resource_manager_tags,
     resource_policies: resource_policies,
     scheduling: scheduling,
     service_account: service_account,
@@ -639,6 +645,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withResourceManagerTags':: d.fn(help='`google.obj.withResourceManagerTags` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the resource_manager_tags field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `resource_manager_tags` field.\n', args=[]),
+  withResourceManagerTags(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_template+: {
+        [resourceLabel]+: {
+          resource_manager_tags: value,
+        },
+      },
+    },
+  },
   '#withResourcePolicies':: d.fn(help='`google.list.withResourcePolicies` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the resource_policies field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `resource_policies` field.\n', args=[]),
   withResourcePolicies(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_region_network_endpoint.libsonnet b/4.x/_gen/resources/compute_region_network_endpoint.libsonnet
new file mode 100644
index 00000000..75d67d26
--- /dev/null
+++ b/4.x/_gen/resources/compute_region_network_endpoint.libsonnet
@@ -0,0 +1,138 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='compute_region_network_endpoint', url='', help='`compute_region_network_endpoint` represents the `google_compute_region_network_endpoint` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.compute_region_network_endpoint.new` injects a new `google_compute_region_network_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_network_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_network_endpoint` using the reference:\n\n    $._ref.google_compute_region_network_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_network_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `fqdn` (`string`): Fully qualified domain name of network endpoint.\n\nThis can only be specified when network_endpoint_type of the NEG is INTERNET_FQDN_PORT. When `null`, the `fqdn` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IPv4 address external endpoint.\n\nThis can only be specified when network_endpoint_type of the NEG is INTERNET_IP_PORT. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `port` (`number`): Port number of network endpoint.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the containing network endpoint group is located. When `null`, the `region` field will be omitted from the resulting object.\n  - `region_network_endpoint_group` (`string`): The network endpoint group this endpoint is part of.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    port,
+    region_network_endpoint_group,
+    fqdn=null,
+    ip_address=null,
+    project=null,
+    region=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_compute_region_network_endpoint',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      fqdn=fqdn,
+      ip_address=ip_address,
+      port=port,
+      project=project,
+      region=region,
+      region_network_endpoint_group=region_network_endpoint_group,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_network_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_endpoint`\nTerraform resource.\n\nUnlike [google.compute_region_network_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `fqdn` (`string`): Fully qualified domain name of network endpoint.\n\nThis can only be specified when network_endpoint_type of the NEG is INTERNET_FQDN_PORT. When `null`, the `fqdn` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IPv4 address external endpoint.\n\nThis can only be specified when network_endpoint_type of the NEG is INTERNET_IP_PORT. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `port` (`number`): Port number of network endpoint.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the containing network endpoint group is located. When `null`, the `region` field will be omitted from the resulting object.\n  - `region_network_endpoint_group` (`string`): The network endpoint group this endpoint is part of.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_network_endpoint` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    port,
+    region_network_endpoint_group,
+    fqdn=null,
+    ip_address=null,
+    project=null,
+    region=null,
+    timeouts=null
+  ):: std.prune(a={
+    fqdn: fqdn,
+    ip_address: ip_address,
+    port: port,
+    project: project,
+    region: region,
+    region_network_endpoint_group: region_network_endpoint_group,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.compute_region_network_endpoint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+    }),
+  },
+  '#withFqdn':: d.fn(help='`google.string.withFqdn` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the fqdn field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `fqdn` field.\n', args=[]),
+  withFqdn(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          fqdn: value,
+        },
+      },
+    },
+  },
+  '#withIpAddress':: d.fn(help='`google.string.withIpAddress` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the ip_address field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `ip_address` field.\n', args=[]),
+  withIpAddress(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          ip_address: value,
+        },
+      },
+    },
+  },
+  '#withPort':: d.fn(help='`google.number.withPort` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the port field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `port` field.\n', args=[]),
+  withPort(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          port: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withRegionNetworkEndpointGroup':: d.fn(help='`google.string.withRegionNetworkEndpointGroup` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region_network_endpoint_group field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region_network_endpoint_group` field.\n', args=[]),
+  withRegionNetworkEndpointGroup(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          region_network_endpoint_group: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_region_network_endpoint+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/compute_region_network_endpoint_group.libsonnet b/4.x/_gen/resources/compute_region_network_endpoint_group.libsonnet
index 865c8f73..11626fb6 100644
--- a/4.x/_gen/resources/compute_region_network_endpoint_group.libsonnet
+++ b/4.x/_gen/resources/compute_region_network_endpoint_group.libsonnet
@@ -36,7 +36,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       url_mask: url_mask,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_network_endpoint_group.new` injects a new `google_compute_region_network_endpoint_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_network_endpoint_group` using the reference:\n\n    $._ref.google_compute_region_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): This field is only used for PSC.\nThe URL of the network to which all network endpoints in the NEG belong. Uses\n\u0026#34;default\u0026#34; project network if unspecified. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS Default value: \u0026#34;SERVERLESS\u0026#34; Possible values: [\u0026#34;SERVERLESS\u0026#34;, \u0026#34;PRIVATE_SERVICE_CONNECT\u0026#34;] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `psc_target_service` (`string`): The target service url used to set up private service connection to\na Google API or a PSC Producer Service Attachment. When `null`, the `psc_target_service` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the Serverless NEGs Reside.\n  - `subnetwork` (`string`): This field is only used for PSC.\nOptional URL of the subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `app_engine` (`list[obj]`): Only valid when networkEndpointType is \u0026#34;SERVERLESS\u0026#34;.\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `app_engine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.app_engine.new](#fn-app_enginenew) constructor.\n  - `cloud_function` (`list[obj]`): Only valid when networkEndpointType is \u0026#34;SERVERLESS\u0026#34;.\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_function` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_function.new](#fn-cloud_functionnew) constructor.\n  - `cloud_run` (`list[obj]`): Only valid when networkEndpointType is \u0026#34;SERVERLESS\u0026#34;.\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_run.new](#fn-cloud_runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_network_endpoint_group.new` injects a new `google_compute_region_network_endpoint_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_network_endpoint_group` using the reference:\n\n    $._ref.google_compute_region_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): This field is only used for PSC and INTERNET NEGs.\n\nThe URL of the network to which all network endpoints in the NEG belong. Uses\n\u0026#34;default\u0026#34; project network if unspecified. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS. Default value: \u0026#34;SERVERLESS\u0026#34; Possible values: [\u0026#34;SERVERLESS\u0026#34;, \u0026#34;PRIVATE_SERVICE_CONNECT\u0026#34;, \u0026#34;INTERNET_IP_PORT\u0026#34;, \u0026#34;INTERNET_FQDN_PORT\u0026#34;] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `psc_target_service` (`string`): This field is only used for PSC and INTERNET NEGs.\n\nThe target service url used to set up private service connection to\na Google API or a PSC Producer Service Attachment. When `null`, the `psc_target_service` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional NEGs reside.\n  - `subnetwork` (`string`): This field is only used for PSC NEGs.\n\nOptional URL of the subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `app_engine` (`list[obj]`): This field is only used for SERVERLESS NEGs.\n\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `app_engine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.app_engine.new](#fn-app_enginenew) constructor.\n  - `cloud_function` (`list[obj]`): This field is only used for SERVERLESS NEGs.\n\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_function` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_function.new](#fn-cloud_functionnew) constructor.\n  - `cloud_run` (`list[obj]`): This field is only used for SERVERLESS NEGs.\n\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_run.new](#fn-cloud_runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -71,7 +71,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_endpoint_group`\nTerraform resource.\n\nUnlike [google.compute_region_network_endpoint_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): This field is only used for PSC.\nThe URL of the network to which all network endpoints in the NEG belong. Uses\n"default" project network if unspecified. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS Default value: "SERVERLESS" Possible values: ["SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `psc_target_service` (`string`): The target service url used to set up private service connection to\na Google API or a PSC Producer Service Attachment. When `null`, the `psc_target_service` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the Serverless NEGs Reside.\n  - `subnetwork` (`string`): This field is only used for PSC.\nOptional URL of the subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `app_engine` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `app_engine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.app_engine.new](#fn-app_enginenew) constructor.\n  - `cloud_function` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_function` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_function.new](#fn-cloud_functionnew) constructor.\n  - `cloud_run` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_run.new](#fn-cloud_runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_network_endpoint_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_endpoint_group`\nTerraform resource.\n\nUnlike [google.compute_region_network_endpoint_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): This field is only used for PSC and INTERNET NEGs.\n\nThe URL of the network to which all network endpoints in the NEG belong. Uses\n"default" project network if unspecified. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS. Default value: "SERVERLESS" Possible values: ["SERVERLESS", "PRIVATE_SERVICE_CONNECT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `psc_target_service` (`string`): This field is only used for PSC and INTERNET NEGs.\n\nThe target service url used to set up private service connection to\na Google API or a PSC Producer Service Attachment. When `null`, the `psc_target_service` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional NEGs reside.\n  - `subnetwork` (`string`): This field is only used for PSC NEGs.\n\nOptional URL of the subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `app_engine` (`list[obj]`): This field is only used for SERVERLESS NEGs.\n\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `app_engine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.app_engine.new](#fn-app_enginenew) constructor.\n  - `cloud_function` (`list[obj]`): This field is only used for SERVERLESS NEGs.\n\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_function` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_function.new](#fn-cloud_functionnew) constructor.\n  - `cloud_run` (`list[obj]`): This field is only used for SERVERLESS NEGs.\n\nOnly one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_run.new](#fn-cloud_runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_network_endpoint_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     region,
diff --git a/4.x/_gen/resources/compute_region_network_firewall_policy.libsonnet b/4.x/_gen/resources/compute_region_network_firewall_policy.libsonnet
index 5913c8fa..17a57a1c 100644
--- a/4.x/_gen/resources/compute_region_network_firewall_policy.libsonnet
+++ b/4.x/_gen/resources/compute_region_network_firewall_policy.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_region_network_firewall_policy', url='', help='`compute_region_network_firewall_policy` represents the `google_compute_region_network_firewall_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_region_network_firewall_policy.new` injects a new `google_compute_region_network_firewall_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_network_firewall_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_network_firewall_policy` using the reference:\n\n    $._ref.google_compute_region_network_firewall_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_network_firewall_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location of this resource. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_network_firewall_policy.new` injects a new `google_compute_region_network_firewall_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_network_firewall_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_network_firewall_policy` using the reference:\n\n    $._ref.google_compute_region_network_firewall_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_network_firewall_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of this resource. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_network_firewall_policy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_firewall_policy`\nTerraform resource.\n\nUnlike [google.compute_region_network_firewall_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location of this resource. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_network_firewall_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_network_firewall_policy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_firewall_policy`\nTerraform resource.\n\nUnlike [google.compute_region_network_firewall_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of this resource. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_network_firewall_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/compute_region_per_instance_config.libsonnet b/4.x/_gen/resources/compute_region_per_instance_config.libsonnet
index 7d9d73e7..4c6146d1 100644
--- a/4.x/_gen/resources/compute_region_per_instance_config.libsonnet
+++ b/4.x/_gen/resources/compute_region_per_instance_config.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_region_per_instance_config', url='', help='`compute_region_per_instance_config` represents the `google_compute_region_per_instance_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_region_per_instance_config.new` injects a new `google_compute_region_per_instance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_per_instance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_per_instance_config` using the reference:\n\n    $._ref.google_compute_region_per_instance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_per_instance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is \u0026#39;NONE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is \u0026#39;REPLACE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the containing instance group manager is located When `null`, the `region` field will be omitted from the resulting object.\n  - `region_instance_group_manager` (`string`): The region instance group manager this instance config is part of.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_per_instance_config.new` injects a new `google_compute_region_per_instance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_per_instance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_per_instance_config` using the reference:\n\n    $._ref.google_compute_region_per_instance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_per_instance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is \u0026#39;NONE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is \u0026#39;REPLACE\u0026#39;. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the containing instance group manager is located When `null`, the `region` field will be omitted from the resulting object.\n  - `region_instance_group_manager` (`string`): The region instance group manager this instance config is part of.\n  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.\nWhen false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -12,6 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     preserved_state=null,
     project=null,
     region=null,
+    remove_instance_on_destroy=null,
     remove_instance_state_on_destroy=null,
     timeouts=null,
     _meta={}
@@ -26,12 +27,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       region=region,
       region_instance_group_manager=region_instance_group_manager,
+      remove_instance_on_destroy=remove_instance_on_destroy,
       remove_instance_state_on_destroy=remove_instance_state_on_destroy,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_per_instance_config.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_per_instance_config`\nTerraform resource.\n\nUnlike [google.compute_region_per_instance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is 'NONE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is 'REPLACE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the containing instance group manager is located When `null`, the `region` field will be omitted from the resulting object.\n  - `region_instance_group_manager` (`string`): The region instance group manager this instance config is part of.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_per_instance_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_per_instance_config.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_per_instance_config`\nTerraform resource.\n\nUnlike [google.compute_region_per_instance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `minimal_action` (`string`): The minimal action to perform on the instance during an update.\nDefault is 'NONE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `minimal_action` field will be omitted from the resulting object.\n  - `most_disruptive_allowed_action` (`string`): The most disruptive action to perform on the instance during an update.\nDefault is 'REPLACE'. Possible values are:\n* REPLACE\n* RESTART\n* REFRESH\n* NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.\n  - `name` (`string`): The name for this per-instance config and its corresponding instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the containing instance group manager is located When `null`, the `region` field will be omitted from the resulting object.\n  - `region_instance_group_manager` (`string`): The region instance group manager this instance config is part of.\n  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.\nWhen false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.\n  - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.\nWhen false, deleting this config will *not* immediately remove any state from the underlying instance.\nState will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.\n  - `preserved_state` (`list[obj]`): The preserved state for this instance. When `null`, the `preserved_state` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.new](#fn-preserved_statenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_per_instance_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     region_instance_group_manager,
@@ -40,6 +42,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     preserved_state=null,
     project=null,
     region=null,
+    remove_instance_on_destroy=null,
     remove_instance_state_on_destroy=null,
     timeouts=null
   ):: std.prune(a={
@@ -50,6 +53,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     region: region,
     region_instance_group_manager: region_instance_group_manager,
+    remove_instance_on_destroy: remove_instance_on_destroy,
     remove_instance_state_on_destroy: remove_instance_state_on_destroy,
     timeouts: timeouts,
   }),
@@ -68,12 +72,56 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         source: source,
       }),
     },
-    '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
+    external_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `external_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    internal_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `internal_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.\n  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
     new(
       disk=null,
+      external_ip=null,
+      internal_ip=null,
       metadata=null
     ):: std.prune(a={
       disk: disk,
+      external_ip: external_ip,
+      internal_ip: internal_ip,
       metadata: metadata,
     }),
   },
@@ -169,6 +217,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRemoveInstanceOnDestroy':: d.fn(help='`google.bool.withRemoveInstanceOnDestroy` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the remove_instance_on_destroy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `remove_instance_on_destroy` field.\n', args=[]),
+  withRemoveInstanceOnDestroy(resourceLabel, value): {
+    resource+: {
+      google_compute_region_per_instance_config+: {
+        [resourceLabel]+: {
+          remove_instance_on_destroy: value,
+        },
+      },
+    },
+  },
   '#withRemoveInstanceStateOnDestroy':: d.fn(help='`google.bool.withRemoveInstanceStateOnDestroy` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the remove_instance_state_on_destroy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `remove_instance_state_on_destroy` field.\n', args=[]),
   withRemoveInstanceStateOnDestroy(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_router_nat.libsonnet b/4.x/_gen/resources/compute_router_nat.libsonnet
index 78d4bc68..e6c49189 100644
--- a/4.x/_gen/resources/compute_router_nat.libsonnet
+++ b/4.x/_gen/resources/compute_router_nat.libsonnet
@@ -12,11 +12,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       filter: filter,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_router_nat.new` injects a new `google_compute_router_nat` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_router_nat.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_router_nat` using the reference:\n\n    $._ref.google_compute_router_nat.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_router_nat.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information\nsee the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n\u0026#39;AUTO_ONLY\u0026#39; for only allowing NAT IPs allocated by Google Cloud\nPlatform, or \u0026#39;MANUAL_ONLY\u0026#39; for only user-allocated NAT IP addresses. Possible values: [\u0026#34;MANUAL_ONLY\u0026#34;, \u0026#34;AUTO_ONLY\u0026#34;]\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#39;, all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#39;, all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n\u0026#39;LIST_OF_SUBNETWORKS\u0026#39;: A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: [\u0026#34;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#34;, \u0026#34;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#34;, \u0026#34;LIST_OF_SUBNETWORKS\u0026#34;]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n\u0026#39;source_subnetwork_ip_ranges_to_nat\u0026#39; is set to \u0026#39;LIST_OF_SUBNETWORKS\u0026#39; When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_router_nat.new` injects a new `google_compute_router_nat` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_router_nat.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_router_nat` using the reference:\n\n    $._ref.google_compute_router_nat.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_router_nat.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.\nFor more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n\u0026#39;AUTO_ONLY\u0026#39; for only allowing NAT IPs allocated by Google Cloud\nPlatform, or \u0026#39;MANUAL_ONLY\u0026#39; for only user-allocated NAT IP addresses. Possible values: [\u0026#34;MANUAL_ONLY\u0026#34;, \u0026#34;AUTO_ONLY\u0026#34;] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#39;, all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#39;, all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n\u0026#39;LIST_OF_SUBNETWORKS\u0026#39;: A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: [\u0026#34;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#34;, \u0026#34;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#34;, \u0026#34;LIST_OF_SUBNETWORKS\u0026#34;]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n\u0026#39;source_subnetwork_ip_ranges_to_nat\u0026#39; is set to \u0026#39;LIST_OF_SUBNETWORKS\u0026#39; When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
-    nat_ip_allocate_option,
     router,
     source_subnetwork_ip_ranges_to_nat,
     drain_nat_ips=null,
@@ -26,6 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     log_config=null,
     max_ports_per_vm=null,
     min_ports_per_vm=null,
+    nat_ip_allocate_option=null,
     nat_ips=null,
     project=null,
     region=null,
@@ -65,10 +65,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_router_nat.newAttrs` constructs a new object with attributes and blocks configured for the `compute_router_nat`\nTerraform resource.\n\nUnlike [google.compute_router_nat.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information\nsee the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud\nPlatform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n'source_subnetwork_ip_ranges_to_nat' is set to 'LIST_OF_SUBNETWORKS' When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_router_nat` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_router_nat.newAttrs` constructs a new object with attributes and blocks configured for the `compute_router_nat`\nTerraform resource.\n\nUnlike [google.compute_router_nat.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.\nFor more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud\nPlatform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n'source_subnetwork_ip_ranges_to_nat' is set to 'LIST_OF_SUBNETWORKS' When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_router_nat` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
-    nat_ip_allocate_option,
     router,
     source_subnetwork_ip_ranges_to_nat,
     drain_nat_ips=null,
@@ -78,6 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     log_config=null,
     max_ports_per_vm=null,
     min_ports_per_vm=null,
+    nat_ip_allocate_option=null,
     nat_ips=null,
     project=null,
     region=null,
diff --git a/4.x/_gen/resources/compute_router_peer.libsonnet b/4.x/_gen/resources/compute_router_peer.libsonnet
index 94dddc27..7ee909b8 100644
--- a/4.x/_gen/resources/compute_router_peer.libsonnet
+++ b/4.x/_gen/resources/compute_router_peer.libsonnet
@@ -26,7 +26,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       session_initialization_mode: session_initialization_mode,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_router_peer.new` injects a new `google_compute_router_peer` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_router_peer.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_router_peer` using the reference:\n\n    $._ref.google_compute_router_peer.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_router_peer.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `advertise_mode` (`string`): User-specified flag to indicate which mode to use for advertisement.\nValid values of this enum field are: \u0026#39;DEFAULT\u0026#39;, \u0026#39;CUSTOM\u0026#39; Default value: \u0026#34;DEFAULT\u0026#34; Possible values: [\u0026#34;DEFAULT\u0026#34;, \u0026#34;CUSTOM\u0026#34;] When `null`, the `advertise_mode` field will be omitted from the resulting object.\n  - `advertised_groups` (`list`): User-specified list of prefix groups to advertise in custom\nmode, which currently supports the following option:\n\n* \u0026#39;ALL_SUBNETS\u0026#39;: Advertises all of the router\u0026#39;s own VPC subnets.\nThis excludes any routes learned for subnets that use VPC Network\nPeering.\n\n\nNote that this field can only be populated if advertiseMode is \u0026#39;CUSTOM\u0026#39;\nand overrides the list defined for the router (in the \u0026#34;bgp\u0026#34; message).\nThese groups are advertised in addition to any specified prefixes.\nLeave this field blank to advertise no custom groups. When `null`, the `advertised_groups` field will be omitted from the resulting object.\n  - `advertised_route_priority` (`number`): The priority of routes advertised to this BGP peer.\nWhere there is more than one matching route of maximum\nlength, the routes with the lowest priority value win. When `null`, the `advertised_route_priority` field will be omitted from the resulting object.\n  - `enable` (`bool`): The status of the BGP peer connection. If set to false, any active session\nwith the peer is terminated and all associated routing information is removed.\nIf set to true, the peer connection can be established with routing information.\nThe default is true. When `null`, the `enable` field will be omitted from the resulting object.\n  - `enable_ipv6` (`bool`): Enable IPv6 traffic over BGP Peer. If not specified, it is disabled by default. When `null`, the `enable_ipv6` field will be omitted from the resulting object.\n  - `interface` (`string`): Name of the interface the BGP peer is associated with.\n  - `ip_address` (`string`): IP address of the interface inside Google Cloud Platform.\nOnly IPv4 is supported. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ipv6_nexthop_address` (`string`): IPv6 address of the interface inside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `name` (`string`): Name of this BGP peer. The name must be 1-63 characters long,\nand comply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_asn` (`number`): Peer BGP Autonomous System Number (ASN).\nEach BGP interface may use a different value.\n  - `peer_ip_address` (`string`): IP address of the BGP interface outside Google Cloud Platform.\nOnly IPv4 is supported. Required if \u0026#39;ip_address\u0026#39; is set. When `null`, the `peer_ip_address` field will be omitted from the resulting object.\n  - `peer_ipv6_nexthop_address` (`string`): IPv6 address of the BGP interface outside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `peer_ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and BgpPeer reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this BgpPeer will be configured.\n  - `router_appliance_instance` (`string`): The URI of the VM instance that is used as third-party router appliances\nsuch as Next Gen Firewalls, Virtual Routers, or Router Appliances.\nThe VM instance must be located in zones contained in the same region as\nthis Cloud Router. The VM instance is the peer side of the BGP session. When `null`, the `router_appliance_instance` field will be omitted from the resulting object.\n  - `advertised_ip_ranges` (`list[obj]`): User-specified list of individual IP ranges to advertise in\ncustom mode. This field can only be populated if advertiseMode\nis \u0026#39;CUSTOM\u0026#39; and is advertised to all peers of the router. These IP\nranges will be advertised in addition to any specified groups.\nLeave this field blank to advertise no custom IP ranges. When `null`, the `advertised_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.advertised_ip_ranges.new](#fn-advertised_ip_rangesnew) constructor.\n  - `bfd` (`list[obj]`): BFD configuration for the BGP peering. When `null`, the `bfd` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.bfd.new](#fn-bfdnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  md5_authentication_key:: {
+    '#new':: d.fn(help='\n`google.compute_router_peer.md5_authentication_key.new` constructs a new object with attributes and blocks configured for the `md5_authentication_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): Value of the key.\n  - `name` (`string`): [REQUIRED] Name used to identify the key.\nMust be unique within a router. Must be referenced by exactly one bgpPeer. Must comply with RFC1035.\n\n**Returns**:\n  - An attribute object that represents the `md5_authentication_key` sub block.\n', args=[]),
+    new(
+      key,
+      name
+    ):: std.prune(a={
+      key: key,
+      name: name,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.compute_router_peer.new` injects a new `google_compute_router_peer` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_router_peer.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_router_peer` using the reference:\n\n    $._ref.google_compute_router_peer.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_router_peer.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `advertise_mode` (`string`): User-specified flag to indicate which mode to use for advertisement.\nValid values of this enum field are: \u0026#39;DEFAULT\u0026#39;, \u0026#39;CUSTOM\u0026#39; Default value: \u0026#34;DEFAULT\u0026#34; Possible values: [\u0026#34;DEFAULT\u0026#34;, \u0026#34;CUSTOM\u0026#34;] When `null`, the `advertise_mode` field will be omitted from the resulting object.\n  - `advertised_groups` (`list`): User-specified list of prefix groups to advertise in custom\nmode, which currently supports the following option:\n\n* \u0026#39;ALL_SUBNETS\u0026#39;: Advertises all of the router\u0026#39;s own VPC subnets.\nThis excludes any routes learned for subnets that use VPC Network\nPeering.\n\n\nNote that this field can only be populated if advertiseMode is \u0026#39;CUSTOM\u0026#39;\nand overrides the list defined for the router (in the \u0026#34;bgp\u0026#34; message).\nThese groups are advertised in addition to any specified prefixes.\nLeave this field blank to advertise no custom groups. When `null`, the `advertised_groups` field will be omitted from the resulting object.\n  - `advertised_route_priority` (`number`): The priority of routes advertised to this BGP peer.\nWhere there is more than one matching route of maximum\nlength, the routes with the lowest priority value win. When `null`, the `advertised_route_priority` field will be omitted from the resulting object.\n  - `enable` (`bool`): The status of the BGP peer connection. If set to false, any active session\nwith the peer is terminated and all associated routing information is removed.\nIf set to true, the peer connection can be established with routing information.\nThe default is true. When `null`, the `enable` field will be omitted from the resulting object.\n  - `enable_ipv6` (`bool`): Enable IPv6 traffic over BGP Peer. If not specified, it is disabled by default. When `null`, the `enable_ipv6` field will be omitted from the resulting object.\n  - `interface` (`string`): Name of the interface the BGP peer is associated with.\n  - `ip_address` (`string`): IP address of the interface inside Google Cloud Platform.\nOnly IPv4 is supported. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ipv6_nexthop_address` (`string`): IPv6 address of the interface inside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `name` (`string`): Name of this BGP peer. The name must be 1-63 characters long,\nand comply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_asn` (`number`): Peer BGP Autonomous System Number (ASN).\nEach BGP interface may use a different value.\n  - `peer_ip_address` (`string`): IP address of the BGP interface outside Google Cloud Platform.\nOnly IPv4 is supported. Required if \u0026#39;ip_address\u0026#39; is set. When `null`, the `peer_ip_address` field will be omitted from the resulting object.\n  - `peer_ipv6_nexthop_address` (`string`): IPv6 address of the BGP interface outside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `peer_ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and BgpPeer reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this BgpPeer will be configured.\n  - `router_appliance_instance` (`string`): The URI of the VM instance that is used as third-party router appliances\nsuch as Next Gen Firewalls, Virtual Routers, or Router Appliances.\nThe VM instance must be located in zones contained in the same region as\nthis Cloud Router. The VM instance is the peer side of the BGP session. When `null`, the `router_appliance_instance` field will be omitted from the resulting object.\n  - `advertised_ip_ranges` (`list[obj]`): User-specified list of individual IP ranges to advertise in\ncustom mode. This field can only be populated if advertiseMode\nis \u0026#39;CUSTOM\u0026#39; and is advertised to all peers of the router. These IP\nranges will be advertised in addition to any specified groups.\nLeave this field blank to advertise no custom IP ranges. When `null`, the `advertised_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.advertised_ip_ranges.new](#fn-advertised_ip_rangesnew) constructor.\n  - `bfd` (`list[obj]`): BFD configuration for the BGP peering. When `null`, the `bfd` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.bfd.new](#fn-bfdnew) constructor.\n  - `md5_authentication_key` (`list[obj]`): Present if MD5 authentication is enabled for the peering. Must be the name\nof one of the entries in the Router.md5_authentication_keys. The field must comply with RFC1035. When `null`, the `md5_authentication_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.md5_authentication_key.new](#fn-md5_authentication_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     interface,
@@ -42,6 +52,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_ipv6=null,
     ip_address=null,
     ipv6_nexthop_address=null,
+    md5_authentication_key=null,
     peer_ip_address=null,
     peer_ipv6_nexthop_address=null,
     project=null,
@@ -63,6 +74,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       interface=interface,
       ip_address=ip_address,
       ipv6_nexthop_address=ipv6_nexthop_address,
+      md5_authentication_key=md5_authentication_key,
       name=name,
       peer_asn=peer_asn,
       peer_ip_address=peer_ip_address,
@@ -75,7 +87,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_router_peer.newAttrs` constructs a new object with attributes and blocks configured for the `compute_router_peer`\nTerraform resource.\n\nUnlike [google.compute_router_peer.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `advertise_mode` (`string`): User-specified flag to indicate which mode to use for advertisement.\nValid values of this enum field are: 'DEFAULT', 'CUSTOM' Default value: "DEFAULT" Possible values: ["DEFAULT", "CUSTOM"] When `null`, the `advertise_mode` field will be omitted from the resulting object.\n  - `advertised_groups` (`list`): User-specified list of prefix groups to advertise in custom\nmode, which currently supports the following option:\n\n* 'ALL_SUBNETS': Advertises all of the router's own VPC subnets.\nThis excludes any routes learned for subnets that use VPC Network\nPeering.\n\n\nNote that this field can only be populated if advertiseMode is 'CUSTOM'\nand overrides the list defined for the router (in the "bgp" message).\nThese groups are advertised in addition to any specified prefixes.\nLeave this field blank to advertise no custom groups. When `null`, the `advertised_groups` field will be omitted from the resulting object.\n  - `advertised_route_priority` (`number`): The priority of routes advertised to this BGP peer.\nWhere there is more than one matching route of maximum\nlength, the routes with the lowest priority value win. When `null`, the `advertised_route_priority` field will be omitted from the resulting object.\n  - `enable` (`bool`): The status of the BGP peer connection. If set to false, any active session\nwith the peer is terminated and all associated routing information is removed.\nIf set to true, the peer connection can be established with routing information.\nThe default is true. When `null`, the `enable` field will be omitted from the resulting object.\n  - `enable_ipv6` (`bool`): Enable IPv6 traffic over BGP Peer. If not specified, it is disabled by default. When `null`, the `enable_ipv6` field will be omitted from the resulting object.\n  - `interface` (`string`): Name of the interface the BGP peer is associated with.\n  - `ip_address` (`string`): IP address of the interface inside Google Cloud Platform.\nOnly IPv4 is supported. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ipv6_nexthop_address` (`string`): IPv6 address of the interface inside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `name` (`string`): Name of this BGP peer. The name must be 1-63 characters long,\nand comply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_asn` (`number`): Peer BGP Autonomous System Number (ASN).\nEach BGP interface may use a different value.\n  - `peer_ip_address` (`string`): IP address of the BGP interface outside Google Cloud Platform.\nOnly IPv4 is supported. Required if 'ip_address' is set. When `null`, the `peer_ip_address` field will be omitted from the resulting object.\n  - `peer_ipv6_nexthop_address` (`string`): IPv6 address of the BGP interface outside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `peer_ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and BgpPeer reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this BgpPeer will be configured.\n  - `router_appliance_instance` (`string`): The URI of the VM instance that is used as third-party router appliances\nsuch as Next Gen Firewalls, Virtual Routers, or Router Appliances.\nThe VM instance must be located in zones contained in the same region as\nthis Cloud Router. The VM instance is the peer side of the BGP session. When `null`, the `router_appliance_instance` field will be omitted from the resulting object.\n  - `advertised_ip_ranges` (`list[obj]`): User-specified list of individual IP ranges to advertise in\ncustom mode. This field can only be populated if advertiseMode\nis 'CUSTOM' and is advertised to all peers of the router. These IP\nranges will be advertised in addition to any specified groups.\nLeave this field blank to advertise no custom IP ranges. When `null`, the `advertised_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.advertised_ip_ranges.new](#fn-advertised_ip_rangesnew) constructor.\n  - `bfd` (`list[obj]`): BFD configuration for the BGP peering. When `null`, the `bfd` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.bfd.new](#fn-bfdnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_router_peer` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_router_peer.newAttrs` constructs a new object with attributes and blocks configured for the `compute_router_peer`\nTerraform resource.\n\nUnlike [google.compute_router_peer.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `advertise_mode` (`string`): User-specified flag to indicate which mode to use for advertisement.\nValid values of this enum field are: 'DEFAULT', 'CUSTOM' Default value: "DEFAULT" Possible values: ["DEFAULT", "CUSTOM"] When `null`, the `advertise_mode` field will be omitted from the resulting object.\n  - `advertised_groups` (`list`): User-specified list of prefix groups to advertise in custom\nmode, which currently supports the following option:\n\n* 'ALL_SUBNETS': Advertises all of the router's own VPC subnets.\nThis excludes any routes learned for subnets that use VPC Network\nPeering.\n\n\nNote that this field can only be populated if advertiseMode is 'CUSTOM'\nand overrides the list defined for the router (in the "bgp" message).\nThese groups are advertised in addition to any specified prefixes.\nLeave this field blank to advertise no custom groups. When `null`, the `advertised_groups` field will be omitted from the resulting object.\n  - `advertised_route_priority` (`number`): The priority of routes advertised to this BGP peer.\nWhere there is more than one matching route of maximum\nlength, the routes with the lowest priority value win. When `null`, the `advertised_route_priority` field will be omitted from the resulting object.\n  - `enable` (`bool`): The status of the BGP peer connection. If set to false, any active session\nwith the peer is terminated and all associated routing information is removed.\nIf set to true, the peer connection can be established with routing information.\nThe default is true. When `null`, the `enable` field will be omitted from the resulting object.\n  - `enable_ipv6` (`bool`): Enable IPv6 traffic over BGP Peer. If not specified, it is disabled by default. When `null`, the `enable_ipv6` field will be omitted from the resulting object.\n  - `interface` (`string`): Name of the interface the BGP peer is associated with.\n  - `ip_address` (`string`): IP address of the interface inside Google Cloud Platform.\nOnly IPv4 is supported. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ipv6_nexthop_address` (`string`): IPv6 address of the interface inside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `name` (`string`): Name of this BGP peer. The name must be 1-63 characters long,\nand comply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_asn` (`number`): Peer BGP Autonomous System Number (ASN).\nEach BGP interface may use a different value.\n  - `peer_ip_address` (`string`): IP address of the BGP interface outside Google Cloud Platform.\nOnly IPv4 is supported. Required if 'ip_address' is set. When `null`, the `peer_ip_address` field will be omitted from the resulting object.\n  - `peer_ipv6_nexthop_address` (`string`): IPv6 address of the BGP interface outside Google Cloud Platform.\nThe address must be in the range 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64.\nIf you do not specify the next hop addresses, Google Cloud automatically\nassigns unused addresses from the 2600:2d00:0:2::/64 or 2600:2d00:0:3::/64 range for you. When `null`, the `peer_ipv6_nexthop_address` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and BgpPeer reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this BgpPeer will be configured.\n  - `router_appliance_instance` (`string`): The URI of the VM instance that is used as third-party router appliances\nsuch as Next Gen Firewalls, Virtual Routers, or Router Appliances.\nThe VM instance must be located in zones contained in the same region as\nthis Cloud Router. The VM instance is the peer side of the BGP session. When `null`, the `router_appliance_instance` field will be omitted from the resulting object.\n  - `advertised_ip_ranges` (`list[obj]`): User-specified list of individual IP ranges to advertise in\ncustom mode. This field can only be populated if advertiseMode\nis 'CUSTOM' and is advertised to all peers of the router. These IP\nranges will be advertised in addition to any specified groups.\nLeave this field blank to advertise no custom IP ranges. When `null`, the `advertised_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.advertised_ip_ranges.new](#fn-advertised_ip_rangesnew) constructor.\n  - `bfd` (`list[obj]`): BFD configuration for the BGP peering. When `null`, the `bfd` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.bfd.new](#fn-bfdnew) constructor.\n  - `md5_authentication_key` (`list[obj]`): Present if MD5 authentication is enabled for the peering. Must be the name\nof one of the entries in the Router.md5_authentication_keys. The field must comply with RFC1035. When `null`, the `md5_authentication_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.md5_authentication_key.new](#fn-md5_authentication_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_router_peer` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     interface,
     name,
@@ -90,6 +102,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_ipv6=null,
     ip_address=null,
     ipv6_nexthop_address=null,
+    md5_authentication_key=null,
     peer_ip_address=null,
     peer_ipv6_nexthop_address=null,
     project=null,
@@ -107,6 +120,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     interface: interface,
     ip_address: ip_address,
     ipv6_nexthop_address: ipv6_nexthop_address,
+    md5_authentication_key: md5_authentication_key,
     name: name,
     peer_asn: peer_asn,
     peer_ip_address: peer_ip_address,
@@ -249,6 +263,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withMd5AuthenticationKey':: d.fn(help='`google.list[obj].withMd5AuthenticationKey` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the md5_authentication_key field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMd5AuthenticationKeyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `md5_authentication_key` field.\n', args=[]),
+  withMd5AuthenticationKey(resourceLabel, value): {
+    resource+: {
+      google_compute_router_peer+: {
+        [resourceLabel]+: {
+          md5_authentication_key: value,
+        },
+      },
+    },
+  },
+  '#withMd5AuthenticationKeyMixin':: d.fn(help='`google.list[obj].withMd5AuthenticationKeyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the md5_authentication_key field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMd5AuthenticationKey](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `md5_authentication_key` field.\n', args=[]),
+  withMd5AuthenticationKeyMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_router_peer+: {
+        [resourceLabel]+: {
+          md5_authentication_key+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
   withName(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_service_attachment.libsonnet b/4.x/_gen/resources/compute_service_attachment.libsonnet
index 47169e7b..35452b0b 100644
--- a/4.x/_gen/resources/compute_service_attachment.libsonnet
+++ b/4.x/_gen/resources/compute_service_attachment.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project_id_or_num: project_id_or_num,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_service_attachment.new` injects a new `google_compute_service_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_service_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_service_attachment` using the reference:\n\n    $._ref.google_compute_service_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_service_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include \u0026#34;ACCEPT_AUTOMATIC\u0026#34;, \u0026#34;ACCEPT_MANUAL\u0026#34;.\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: \u0026#34;p.mycompany.com.\u0026#34;. Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.\n\nFor newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_service_attachment.new` injects a new `google_compute_service_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_service_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_service_attachment` using the reference:\n\n    $._ref.google_compute_service_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_service_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include \u0026#34;ACCEPT_AUTOMATIC\u0026#34;, \u0026#34;ACCEPT_MANUAL\u0026#34;.\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: \u0026#34;p.mycompany.com.\u0026#34;. Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     connection_preference,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_service_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `compute_service_attachment`\nTerraform resource.\n\nUnlike [google.compute_service_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include "ACCEPT_AUTOMATIC", "ACCEPT_MANUAL".\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: "p.mycompany.com.". Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.\n\nFor newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_service_attachment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_service_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `compute_service_attachment`\nTerraform resource.\n\nUnlike [google.compute_service_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include "ACCEPT_AUTOMATIC", "ACCEPT_MANUAL".\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: "p.mycompany.com.". Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_service_attachment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     connection_preference,
     enable_proxy_protocol,
diff --git a/4.x/_gen/resources/compute_snapshot.libsonnet b/4.x/_gen/resources/compute_snapshot.libsonnet
index 0a29fb57..ffa377dc 100644
--- a/4.x/_gen/resources/compute_snapshot.libsonnet
+++ b/4.x/_gen/resources/compute_snapshot.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_snapshot', url='', help='`compute_snapshot` represents the `google_compute_snapshot` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_snapshot.new` injects a new `google_compute_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_snapshot` using the reference:\n\n    $._ref.google_compute_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_snapshot.new` injects a new `google_compute_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_snapshot` using the reference:\n\n    $._ref.google_compute_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `compute_snapshot`\nTerraform resource.\n\nUnlike [google.compute_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_snapshot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `compute_snapshot`\nTerraform resource.\n\nUnlike [google.compute_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_snapshot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     source_disk,
diff --git a/4.x/_gen/resources/compute_subnetwork.libsonnet b/4.x/_gen/resources/compute_subnetwork.libsonnet
index 9abf15df..dddd3140 100644
--- a/4.x/_gen/resources/compute_subnetwork.libsonnet
+++ b/4.x/_gen/resources/compute_subnetwork.libsonnet
@@ -18,13 +18,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       metadata_fields: metadata_fields,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_subnetwork.new` injects a new `google_compute_subnetwork` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_subnetwork.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_subnetwork` using the reference:\n\n    $._ref.google_compute_subnetwork.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_subnetwork.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It\u0026#39;s immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;INTERNAL\u0026#34;] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either \u0026#39;PRIVATE_RFC_1918\u0026#39;, \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;, \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;, or \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39;.\nA subnet with purpose set to \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39; is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39; reserves the subnet for hosting a Private Service Connect published service.\nNote that \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to \u0026#39;PRIVATE_RFC_1918\u0026#39;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when \u0026#39;purpose\u0026#39; is \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;.\nThe value can be set to \u0026#39;ACTIVE\u0026#39; or \u0026#39;BACKUP\u0026#39;.\nAn \u0026#39;ACTIVE\u0026#39; subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA \u0026#39;BACKUP\u0026#39; subnetwork is one that is ready to be promoted to \u0026#39;ACTIVE\u0026#39; or is currently draining. Possible values: [\u0026#34;ACTIVE\u0026#34;, \u0026#34;BACKUP\u0026#34;] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n\u0026#39;example=[]\u0026#39;\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: [\u0026#34;IPV4_ONLY\u0026#34;, \u0026#34;IPV4_IPV6\u0026#34;] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn\u0026#39;t supported if the subnet \u0026#39;purpose\u0026#39; field is set to subnetwork is\n\u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; or \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_subnetwork.new` injects a new `google_compute_subnetwork` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_subnetwork.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_subnetwork` using the reference:\n\n    $._ref.google_compute_subnetwork.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_subnetwork.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `external_ipv6_prefix` (`string`): The range of external IPv6 addresses that are owned by this subnetwork. When `null`, the `external_ipv6_prefix` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It\u0026#39;s immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;INTERNAL\u0026#34;] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either \u0026#39;PRIVATE_RFC_1918\u0026#39;, \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;, \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;, \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39; or \u0026#39;PRIVATE_NAT\u0026#39;([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).\nA subnet with purpose set to \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39; is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39; reserves the subnet for hosting a Private Service Connect published service.\nA subnetwork with purpose set to \u0026#39;PRIVATE_NAT\u0026#39; is used as source range for Private NAT gateways.\nNote that \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to \u0026#39;PRIVATE_RFC_1918\u0026#39;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when \u0026#39;purpose\u0026#39; is \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;.\nThe value can be set to \u0026#39;ACTIVE\u0026#39; or \u0026#39;BACKUP\u0026#39;.\nAn \u0026#39;ACTIVE\u0026#39; subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA \u0026#39;BACKUP\u0026#39; subnetwork is one that is ready to be promoted to \u0026#39;ACTIVE\u0026#39; or is currently draining. Possible values: [\u0026#34;ACTIVE\u0026#34;, \u0026#34;BACKUP\u0026#34;] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n\u0026#39;example=[]\u0026#39;\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: [\u0026#34;IPV4_ONLY\u0026#34;, \u0026#34;IPV4_IPV6\u0026#34;] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn\u0026#39;t supported if the subnet \u0026#39;purpose\u0026#39; field is set to subnetwork is\n\u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; or \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     ip_cidr_range,
     name,
     network,
     description=null,
+    external_ipv6_prefix=null,
     ipv6_access_type=null,
     log_config=null,
     private_ip_google_access=null,
@@ -42,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       description=description,
+      external_ipv6_prefix=external_ipv6_prefix,
       ip_cidr_range=ip_cidr_range,
       ipv6_access_type=ipv6_access_type,
       log_config=log_config,
@@ -59,12 +61,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_subnetwork.newAttrs` constructs a new object with attributes and blocks configured for the `compute_subnetwork`\nTerraform resource.\n\nUnlike [google.compute_subnetwork.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It's immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: ["EXTERNAL", "INTERNAL"] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'.\nA subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.\nNote that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when 'purpose' is 'REGIONAL_MANAGED_PROXY'.\nThe value can be set to 'ACTIVE' or 'BACKUP'.\nAn 'ACTIVE' subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA 'BACKUP' subnetwork is one that is ready to be promoted to 'ACTIVE' or is currently draining. Possible values: ["ACTIVE", "BACKUP"] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n'example=[]'\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: ["IPV4_ONLY", "IPV4_IPV6"] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn't supported if the subnet 'purpose' field is set to subnetwork is\n'REGIONAL_MANAGED_PROXY' or 'GLOBAL_MANAGED_PROXY'. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_subnetwork` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_subnetwork.newAttrs` constructs a new object with attributes and blocks configured for the `compute_subnetwork`\nTerraform resource.\n\nUnlike [google.compute_subnetwork.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `external_ipv6_prefix` (`string`): The range of external IPv6 addresses that are owned by this subnetwork. When `null`, the `external_ipv6_prefix` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It's immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: ["EXTERNAL", "INTERNAL"] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', 'PRIVATE_SERVICE_CONNECT' or 'PRIVATE_NAT'([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).\nA subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.\nA subnetwork with purpose set to 'PRIVATE_NAT' is used as source range for Private NAT gateways.\nNote that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when 'purpose' is 'REGIONAL_MANAGED_PROXY'.\nThe value can be set to 'ACTIVE' or 'BACKUP'.\nAn 'ACTIVE' subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA 'BACKUP' subnetwork is one that is ready to be promoted to 'ACTIVE' or is currently draining. Possible values: ["ACTIVE", "BACKUP"] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n'example=[]'\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: ["IPV4_ONLY", "IPV4_IPV6"] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn't supported if the subnet 'purpose' field is set to subnetwork is\n'REGIONAL_MANAGED_PROXY' or 'GLOBAL_MANAGED_PROXY'. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_subnetwork` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     ip_cidr_range,
     name,
     network,
     description=null,
+    external_ipv6_prefix=null,
     ipv6_access_type=null,
     log_config=null,
     private_ip_google_access=null,
@@ -78,6 +81,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts=null
   ):: std.prune(a={
     description: description,
+    external_ipv6_prefix: external_ipv6_prefix,
     ip_cidr_range: ip_cidr_range,
     ipv6_access_type: ipv6_access_type,
     log_config: log_config,
@@ -115,6 +119,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withExternalIpv6Prefix':: d.fn(help='`google.string.withExternalIpv6Prefix` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the external_ipv6_prefix field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `external_ipv6_prefix` field.\n', args=[]),
+  withExternalIpv6Prefix(resourceLabel, value): {
+    resource+: {
+      google_compute_subnetwork+: {
+        [resourceLabel]+: {
+          external_ipv6_prefix: value,
+        },
+      },
+    },
+  },
   '#withIpCidrRange':: d.fn(help='`google.string.withIpCidrRange` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the ip_cidr_range field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `ip_cidr_range` field.\n', args=[]),
   withIpCidrRange(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_target_https_proxy.libsonnet b/4.x/_gen/resources/compute_target_https_proxy.libsonnet
index f296f12f..e00c966b 100644
--- a/4.x/_gen/resources/compute_target_https_proxy.libsonnet
+++ b/4.x/_gen/resources/compute_target_https_proxy.libsonnet
@@ -2,11 +2,12 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_target_https_proxy', url='', help='`compute_target_https_proxy` represents the `google_compute_target_https_proxy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_target_https_proxy.new` injects a new `google_compute_target_https_proxy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_target_https_proxy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_target_https_proxy` using the reference:\n\n    $._ref.google_compute_target_https_proxy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_target_https_proxy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is \u0026#39;//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}\u0026#39;. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ENABLE\u0026#34;, \u0026#34;DISABLE\u0026#34;] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate\nconnections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_target_https_proxy.new` injects a new `google_compute_target_https_proxy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_target_https_proxy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_target_https_proxy` using the reference:\n\n    $._ref.google_compute_target_https_proxy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_target_https_proxy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates fields can not be defined together.\nAccepted format is \u0026#39;//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}\u0026#39; or just the self_link \u0026#39;projects/{project}/locations/{location}/certificates/{resourceName}\u0026#39; When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is \u0026#39;//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}\u0026#39;. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ENABLE\u0026#34;, \u0026#34;DISABLE\u0026#34;] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
     url_map,
+    certificate_manager_certificates=null,
     certificate_map=null,
     description=null,
     http_keep_alive_timeout_sec=null,
@@ -22,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_compute_target_https_proxy',
     label=resourceLabel,
     attrs=self.newAttrs(
+      certificate_manager_certificates=certificate_manager_certificates,
       certificate_map=certificate_map,
       description=description,
       http_keep_alive_timeout_sec=http_keep_alive_timeout_sec,
@@ -37,10 +39,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_target_https_proxy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_target_https_proxy`\nTerraform resource.\n\nUnlike [google.compute_target_https_proxy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: "NONE" Possible values: ["NONE", "ENABLE", "DISABLE"] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate\nconnections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_target_https_proxy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_target_https_proxy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_target_https_proxy`\nTerraform resource.\n\nUnlike [google.compute_target_https_proxy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates fields can not be defined together.\nAccepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}' or just the self_link 'projects/{project}/locations/{location}/certificates/{resourceName}' When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: "NONE" Possible values: ["NONE", "ENABLE", "DISABLE"] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_target_https_proxy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     url_map,
+    certificate_manager_certificates=null,
     certificate_map=null,
     description=null,
     http_keep_alive_timeout_sec=null,
@@ -52,6 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ssl_policy=null,
     timeouts=null
   ):: std.prune(a={
+    certificate_manager_certificates: certificate_manager_certificates,
     certificate_map: certificate_map,
     description: description,
     http_keep_alive_timeout_sec: http_keep_alive_timeout_sec,
@@ -77,6 +81,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withCertificateManagerCertificates':: d.fn(help='`google.list.withCertificateManagerCertificates` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the certificate_manager_certificates field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `certificate_manager_certificates` field.\n', args=[]),
+  withCertificateManagerCertificates(resourceLabel, value): {
+    resource+: {
+      google_compute_target_https_proxy+: {
+        [resourceLabel]+: {
+          certificate_manager_certificates: value,
+        },
+      },
+    },
+  },
   '#withCertificateMap':: d.fn(help='`google.string.withCertificateMap` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the certificate_map field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `certificate_map` field.\n', args=[]),
   withCertificateMap(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_vpn_tunnel.libsonnet b/4.x/_gen/resources/compute_vpn_tunnel.libsonnet
index c3c51669..7585c982 100644
--- a/4.x/_gen/resources/compute_vpn_tunnel.libsonnet
+++ b/4.x/_gen/resources/compute_vpn_tunnel.libsonnet
@@ -2,13 +2,14 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_vpn_tunnel', url='', help='`compute_vpn_tunnel` represents the `google_compute_vpn_tunnel` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_vpn_tunnel.new` injects a new `google_compute_vpn_tunnel` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_vpn_tunnel.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_vpn_tunnel` using the reference:\n\n    $._ref.google_compute_vpn_tunnel.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_vpn_tunnel.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ike_version` (`number`): IKE protocol version to use when establishing the VPN tunnel with\npeer VPN gateway.\nAcceptable IKE versions are 1 or 2. Default version is 2. When `null`, the `ike_version` field will be omitted from the resulting object.\n  - `local_traffic_selector` (`list`): Local traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example \u0026#39;192.168.0.0/16\u0026#39;. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `local_traffic_selector` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63\ncharacters long and match the regular expression\n\u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first character\nmust be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_external_gateway` (`string`): URL of the peer side external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway` field will be omitted from the resulting object.\n  - `peer_external_gateway_interface` (`number`): The interface ID of the external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway_interface` field will be omitted from the resulting object.\n  - `peer_gcp_gateway` (`string`): URL of the peer side HA GCP VPN gateway to which this VPN tunnel is connected.\nIf provided, the VPN tunnel will automatically use the same vpn_gateway_interface\nID in the peer GCP VPN gateway.\nThis field must reference a \u0026#39;google_compute_ha_vpn_gateway\u0026#39; resource. When `null`, the `peer_gcp_gateway` field will be omitted from the resulting object.\n  - `peer_ip` (`string`): IP address of the peer VPN gateway. Only IPv4 is supported. When `null`, the `peer_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the tunnel is located. If unset, is set to the region of \u0026#39;target_vpn_gateway\u0026#39;. When `null`, the `region` field will be omitted from the resulting object.\n  - `remote_traffic_selector` (`list`): Remote traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example \u0026#39;192.168.0.0/16\u0026#39;. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `remote_traffic_selector` field will be omitted from the resulting object.\n  - `router` (`string`): URL of router resource to be used for dynamic routing. When `null`, the `router` field will be omitted from the resulting object.\n  - `shared_secret` (`string`): Shared secret used to set the secure session between the Cloud VPN\ngateway and the peer VPN gateway.\n  - `target_vpn_gateway` (`string`): URL of the Target VPN gateway with which this VPN tunnel is\nassociated. When `null`, the `target_vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway` (`string`): URL of the VPN gateway with which this VPN tunnel is associated.\nThis must be used if a High Availability VPN gateway resource is created.\nThis field must reference a \u0026#39;google_compute_ha_vpn_gateway\u0026#39; resource. When `null`, the `vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway_interface` (`number`): The interface ID of the VPN gateway with which this VPN tunnel is associated. When `null`, the `vpn_gateway_interface` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_vpn_tunnel.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_vpn_tunnel.new` injects a new `google_compute_vpn_tunnel` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_vpn_tunnel.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_vpn_tunnel` using the reference:\n\n    $._ref.google_compute_vpn_tunnel.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_vpn_tunnel.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ike_version` (`number`): IKE protocol version to use when establishing the VPN tunnel with\npeer VPN gateway.\nAcceptable IKE versions are 1 or 2. Default version is 2. When `null`, the `ike_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this VpnTunnel.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_traffic_selector` (`list`): Local traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example \u0026#39;192.168.0.0/16\u0026#39;. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `local_traffic_selector` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63\ncharacters long and match the regular expression\n\u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first character\nmust be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_external_gateway` (`string`): URL of the peer side external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway` field will be omitted from the resulting object.\n  - `peer_external_gateway_interface` (`number`): The interface ID of the external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway_interface` field will be omitted from the resulting object.\n  - `peer_gcp_gateway` (`string`): URL of the peer side HA GCP VPN gateway to which this VPN tunnel is connected.\nIf provided, the VPN tunnel will automatically use the same vpn_gateway_interface\nID in the peer GCP VPN gateway.\nThis field must reference a \u0026#39;google_compute_ha_vpn_gateway\u0026#39; resource. When `null`, the `peer_gcp_gateway` field will be omitted from the resulting object.\n  - `peer_ip` (`string`): IP address of the peer VPN gateway. Only IPv4 is supported. When `null`, the `peer_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the tunnel is located. If unset, is set to the region of \u0026#39;target_vpn_gateway\u0026#39;. When `null`, the `region` field will be omitted from the resulting object.\n  - `remote_traffic_selector` (`list`): Remote traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example \u0026#39;192.168.0.0/16\u0026#39;. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `remote_traffic_selector` field will be omitted from the resulting object.\n  - `router` (`string`): URL of router resource to be used for dynamic routing. When `null`, the `router` field will be omitted from the resulting object.\n  - `shared_secret` (`string`): Shared secret used to set the secure session between the Cloud VPN\ngateway and the peer VPN gateway.\n  - `target_vpn_gateway` (`string`): URL of the Target VPN gateway with which this VPN tunnel is\nassociated. When `null`, the `target_vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway` (`string`): URL of the VPN gateway with which this VPN tunnel is associated.\nThis must be used if a High Availability VPN gateway resource is created.\nThis field must reference a \u0026#39;google_compute_ha_vpn_gateway\u0026#39; resource. When `null`, the `vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway_interface` (`number`): The interface ID of the VPN gateway with which this VPN tunnel is associated. When `null`, the `vpn_gateway_interface` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_vpn_tunnel.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
     shared_secret,
     description=null,
     ike_version=null,
+    labels=null,
     local_traffic_selector=null,
     peer_external_gateway=null,
     peer_external_gateway_interface=null,
@@ -29,6 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     attrs=self.newAttrs(
       description=description,
       ike_version=ike_version,
+      labels=labels,
       local_traffic_selector=local_traffic_selector,
       name=name,
       peer_external_gateway=peer_external_gateway,
@@ -47,12 +49,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_vpn_tunnel.newAttrs` constructs a new object with attributes and blocks configured for the `compute_vpn_tunnel`\nTerraform resource.\n\nUnlike [google.compute_vpn_tunnel.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ike_version` (`number`): IKE protocol version to use when establishing the VPN tunnel with\npeer VPN gateway.\nAcceptable IKE versions are 1 or 2. Default version is 2. When `null`, the `ike_version` field will be omitted from the resulting object.\n  - `local_traffic_selector` (`list`): Local traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example '192.168.0.0/16'. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `local_traffic_selector` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63\ncharacters long and match the regular expression\n'[a-z]([-a-z0-9]*[a-z0-9])?' which means the first character\nmust be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_external_gateway` (`string`): URL of the peer side external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway` field will be omitted from the resulting object.\n  - `peer_external_gateway_interface` (`number`): The interface ID of the external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway_interface` field will be omitted from the resulting object.\n  - `peer_gcp_gateway` (`string`): URL of the peer side HA GCP VPN gateway to which this VPN tunnel is connected.\nIf provided, the VPN tunnel will automatically use the same vpn_gateway_interface\nID in the peer GCP VPN gateway.\nThis field must reference a 'google_compute_ha_vpn_gateway' resource. When `null`, the `peer_gcp_gateway` field will be omitted from the resulting object.\n  - `peer_ip` (`string`): IP address of the peer VPN gateway. Only IPv4 is supported. When `null`, the `peer_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the tunnel is located. If unset, is set to the region of 'target_vpn_gateway'. When `null`, the `region` field will be omitted from the resulting object.\n  - `remote_traffic_selector` (`list`): Remote traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example '192.168.0.0/16'. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `remote_traffic_selector` field will be omitted from the resulting object.\n  - `router` (`string`): URL of router resource to be used for dynamic routing. When `null`, the `router` field will be omitted from the resulting object.\n  - `shared_secret` (`string`): Shared secret used to set the secure session between the Cloud VPN\ngateway and the peer VPN gateway.\n  - `target_vpn_gateway` (`string`): URL of the Target VPN gateway with which this VPN tunnel is\nassociated. When `null`, the `target_vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway` (`string`): URL of the VPN gateway with which this VPN tunnel is associated.\nThis must be used if a High Availability VPN gateway resource is created.\nThis field must reference a 'google_compute_ha_vpn_gateway' resource. When `null`, the `vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway_interface` (`number`): The interface ID of the VPN gateway with which this VPN tunnel is associated. When `null`, the `vpn_gateway_interface` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_vpn_tunnel.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_vpn_tunnel` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_vpn_tunnel.newAttrs` constructs a new object with attributes and blocks configured for the `compute_vpn_tunnel`\nTerraform resource.\n\nUnlike [google.compute_vpn_tunnel.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ike_version` (`number`): IKE protocol version to use when establishing the VPN tunnel with\npeer VPN gateway.\nAcceptable IKE versions are 1 or 2. Default version is 2. When `null`, the `ike_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this VpnTunnel.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_traffic_selector` (`list`): Local traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example '192.168.0.0/16'. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `local_traffic_selector` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63\ncharacters long and match the regular expression\n'[a-z]([-a-z0-9]*[a-z0-9])?' which means the first character\nmust be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `peer_external_gateway` (`string`): URL of the peer side external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway` field will be omitted from the resulting object.\n  - `peer_external_gateway_interface` (`number`): The interface ID of the external VPN gateway to which this VPN tunnel is connected. When `null`, the `peer_external_gateway_interface` field will be omitted from the resulting object.\n  - `peer_gcp_gateway` (`string`): URL of the peer side HA GCP VPN gateway to which this VPN tunnel is connected.\nIf provided, the VPN tunnel will automatically use the same vpn_gateway_interface\nID in the peer GCP VPN gateway.\nThis field must reference a 'google_compute_ha_vpn_gateway' resource. When `null`, the `peer_gcp_gateway` field will be omitted from the resulting object.\n  - `peer_ip` (`string`): IP address of the peer VPN gateway. Only IPv4 is supported. When `null`, the `peer_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the tunnel is located. If unset, is set to the region of 'target_vpn_gateway'. When `null`, the `region` field will be omitted from the resulting object.\n  - `remote_traffic_selector` (`list`): Remote traffic selector to use when establishing the VPN tunnel with\npeer VPN gateway. The value should be a CIDR formatted string,\nfor example '192.168.0.0/16'. The ranges should be disjoint.\nOnly IPv4 is supported. When `null`, the `remote_traffic_selector` field will be omitted from the resulting object.\n  - `router` (`string`): URL of router resource to be used for dynamic routing. When `null`, the `router` field will be omitted from the resulting object.\n  - `shared_secret` (`string`): Shared secret used to set the secure session between the Cloud VPN\ngateway and the peer VPN gateway.\n  - `target_vpn_gateway` (`string`): URL of the Target VPN gateway with which this VPN tunnel is\nassociated. When `null`, the `target_vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway` (`string`): URL of the VPN gateway with which this VPN tunnel is associated.\nThis must be used if a High Availability VPN gateway resource is created.\nThis field must reference a 'google_compute_ha_vpn_gateway' resource. When `null`, the `vpn_gateway` field will be omitted from the resulting object.\n  - `vpn_gateway_interface` (`number`): The interface ID of the VPN gateway with which this VPN tunnel is associated. When `null`, the `vpn_gateway_interface` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_vpn_tunnel.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_vpn_tunnel` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     shared_secret,
     description=null,
     ike_version=null,
+    labels=null,
     local_traffic_selector=null,
     peer_external_gateway=null,
     peer_external_gateway_interface=null,
@@ -69,6 +72,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   ):: std.prune(a={
     description: description,
     ike_version: ike_version,
+    labels: labels,
     local_traffic_selector: local_traffic_selector,
     name: name,
     peer_external_gateway: peer_external_gateway,
@@ -86,13 +90,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     vpn_gateway_interface: vpn_gateway_interface,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.compute_vpn_tunnel.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_vpn_tunnel.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
@@ -115,6 +121,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_compute_vpn_tunnel+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
   '#withLocalTrafficSelector':: d.fn(help='`google.list.withLocalTrafficSelector` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the local_traffic_selector field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `local_traffic_selector` field.\n', args=[]),
   withLocalTrafficSelector(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_attached_cluster.libsonnet b/4.x/_gen/resources/container_attached_cluster.libsonnet
index 8bb53877..e930a2c7 100644
--- a/4.x/_gen/resources/container_attached_cluster.libsonnet
+++ b/4.x/_gen/resources/container_attached_cluster.libsonnet
@@ -3,10 +3,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='container_attached_cluster', url='', help='`container_attached_cluster` represents the `google_container_attached_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   authorization:: {
-    '#new':: d.fn(help='\n`google.container_attached_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list`): Users that can perform operations as a cluster admin. A managed\nClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole\nto the users. Up to ten admin users can be provided.\n\nFor more info on RBAC, see\nhttps://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_attached_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_groups` (`list`): Groups that can perform operations as a cluster admin. A managed\nClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole\nto the groups. Up to ten admin groups can be provided.\n\nFor more info on RBAC, see\nhttps://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` field will be omitted from the resulting object.\n  - `admin_users` (`list`): Users that can perform operations as a cluster admin. A managed\nClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole\nto the users. Up to ten admin users can be provided.\n\nFor more info on RBAC, see\nhttps://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
     new(
+      admin_groups=null,
       admin_users=null
     ):: std.prune(a={
+      admin_groups: admin_groups,
       admin_users: admin_users,
     }),
   },
@@ -58,7 +60,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       managed_prometheus_config: managed_prometheus_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_attached_cluster.new` injects a new `google_container_attached_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_attached_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_attached_cluster` using the reference:\n\n    $._ref.google_container_attached_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_attached_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n\u0026#34;eks\u0026#34;, \u0026#34;aks\u0026#34;.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. \u0026#39;1.23.0-gke.1\u0026#39;).\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the \u0026#39;issuer_url\u0026#39; field\nwhile clusters with private issuers need to provide both\n\u0026#39;issuer_url\u0026#39; and \u0026#39;jwks\u0026#39;. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_attached_cluster.new` injects a new `google_container_attached_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_attached_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_attached_cluster` using the reference:\n\n    $._ref.google_container_attached_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_attached_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n\u0026#34;eks\u0026#34;, \u0026#34;aks\u0026#34;.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. \u0026#39;1.23.0-gke.1\u0026#39;).\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the \u0026#39;issuer_url\u0026#39; field\nwhile clusters with private issuers need to provide both\n\u0026#39;issuer_url\u0026#39; and \u0026#39;jwks\u0026#39;. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `proxy_config` (`list[obj]`): Support for proxy configuration. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.proxy_config.new](#fn-proxy_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     distribution,
@@ -75,6 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     monitoring_config=null,
     oidc_config=null,
     project=null,
+    proxy_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -95,11 +98,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       oidc_config=oidc_config,
       platform_version=platform_version,
       project=project,
+      proxy_config=proxy_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_attached_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_attached_cluster`\nTerraform resource.\n\nUnlike [google.container_attached_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n"eks", "aks".\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. '1.23.0-gke.1').\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the 'issuer_url' field\nwhile clusters with private issuers need to provide both\n'issuer_url' and 'jwks'. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_attached_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_attached_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_attached_cluster`\nTerraform resource.\n\nUnlike [google.container_attached_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n"eks", "aks".\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. '1.23.0-gke.1').\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the 'issuer_url' field\nwhile clusters with private issuers need to provide both\n'issuer_url' and 'jwks'. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `proxy_config` (`list[obj]`): Support for proxy configuration. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.proxy_config.new](#fn-proxy_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_attached_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     distribution,
     location,
@@ -115,6 +119,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     monitoring_config=null,
     oidc_config=null,
     project=null,
+    proxy_config=null,
     timeouts=null
   ):: std.prune(a={
     annotations: annotations,
@@ -131,6 +136,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     oidc_config: oidc_config,
     platform_version: platform_version,
     project: project,
+    proxy_config: proxy_config,
     timeouts: timeouts,
   }),
   oidc_config:: {
@@ -143,6 +149,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       jwks: jwks,
     }),
   },
+  proxy_config:: {
+    kubernetes_secret:: {
+      '#new':: d.fn(help='\n`google.container_attached_cluster.proxy_config.kubernetes_secret.new` constructs a new object with attributes and blocks configured for the `kubernetes_secret`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the kubernetes secret containing the proxy config.\n  - `namespace` (`string`): Namespace of the kubernetes secret containing the proxy config.\n\n**Returns**:\n  - An attribute object that represents the `kubernetes_secret` sub block.\n', args=[]),
+      new(
+        name,
+        namespace
+      ):: std.prune(a={
+        name: name,
+        namespace: namespace,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.container_attached_cluster.proxy_config.new` constructs a new object with attributes and blocks configured for the `proxy_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kubernetes_secret` (`list[obj]`): The Kubernetes Secret resource that contains the HTTP(S) proxy configuration. When `null`, the `kubernetes_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.proxy_config.kubernetes_secret.new](#fn-proxy_configkubernetes_secretnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `proxy_config` sub block.\n', args=[]),
+    new(
+      kubernetes_secret=null
+    ):: std.prune(a={
+      kubernetes_secret: kubernetes_secret,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.container_attached_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -355,6 +379,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withProxyConfig':: d.fn(help='`google.list[obj].withProxyConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withProxyConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy_config` field.\n', args=[]),
+  withProxyConfig(resourceLabel, value): {
+    resource+: {
+      google_container_attached_cluster+: {
+        [resourceLabel]+: {
+          proxy_config: value,
+        },
+      },
+    },
+  },
+  '#withProxyConfigMixin':: d.fn(help='`google.list[obj].withProxyConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withProxyConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy_config` field.\n', args=[]),
+  withProxyConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_container_attached_cluster+: {
+        [resourceLabel]+: {
+          proxy_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_aws_cluster.libsonnet b/4.x/_gen/resources/container_aws_cluster.libsonnet
index 5681ea45..e311d215 100644
--- a/4.x/_gen/resources/container_aws_cluster.libsonnet
+++ b/4.x/_gen/resources/container_aws_cluster.libsonnet
@@ -3,6 +3,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='container_aws_cluster', url='', help='`container_aws_cluster` represents the `google_container_aws_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   authorization:: {
+    admin_groups:: {
+      '#new':: d.fn(help='\n`google.container_aws_cluster.authorization.admin_groups.new` constructs a new object with attributes and blocks configured for the `admin_groups`\nTerraform sub block.\n\n\n\n**Args**:\n  - `group` (`string`): The name of the group, e.g. `my-group@domain.com`.\n\n**Returns**:\n  - An attribute object that represents the `admin_groups` sub block.\n', args=[]),
+      new(
+        group
+      ):: std.prune(a={
+        group: group,
+      }),
+    },
     admin_users:: {
       '#new':: d.fn(help='\n`google.container_aws_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. `my-gcp-id@gmail.com`.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
       new(
@@ -11,13 +19,23 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         username: username,
       }),
     },
-    '#new':: d.fn(help='\n`google.container_aws_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users to perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_aws_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_groups` (`list[obj]`): Groups of users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the groups. Up to ten admin groups can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.admin_groups.new](#fn-authorizationadmin_groupsnew) constructor.\n  - `admin_users` (`list[obj]`): Users to perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
     new(
+      admin_groups=null,
       admin_users=null
     ):: std.prune(a={
+      admin_groups: admin_groups,
       admin_users: admin_users,
     }),
   },
+  binary_authorization:: {
+    '#new':: d.fn(help='\n`google.container_aws_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `evaluation_mode` (`string`): Mode of operation for Binary Authorization policy evaluation. Possible values: DISABLED, PROJECT_SINGLETON_POLICY_ENFORCE When `null`, the `evaluation_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `binary_authorization` sub block.\n', args=[]),
+    new(
+      evaluation_mode=null
+    ):: std.prune(a={
+      evaluation_mode: evaluation_mode,
+    }),
+  },
   control_plane:: {
     aws_services_authentication:: {
       '#new':: d.fn(help='\n`google.container_aws_cluster.control_plane.aws_services_authentication.new` constructs a new object with attributes and blocks configured for the `aws_services_authentication`\nTerraform sub block.\n\n\n\n**Args**:\n  - `role_arn` (`string`): The Amazon Resource Name (ARN) of the role that the Anthos Multi-Cloud API will assume when managing AWS resources on your account.\n  - `role_session_name` (`string`): Optional. An identifier for the assumed role session. When unspecified, it defaults to `multicloud-service-agent`. When `null`, the `role_session_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `aws_services_authentication` sub block.\n', args=[]),
@@ -46,7 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     main_volume:: {
-      '#new':: d.fn(help='\n`google.container_aws_cluster.control_plane.main_volume.new` constructs a new object with attributes and blocks configured for the `main_volume`\nTerraform sub block.\n\n\n\n**Args**:\n  - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.\n  - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.\n  - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.\n  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. When `null`, the `throughput` field will be omitted from the resulting object.\n  - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `main_volume` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_aws_cluster.control_plane.main_volume.new` constructs a new object with attributes and blocks configured for the `main_volume`\nTerraform sub block.\n\n\n\n**Args**:\n  - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.\n  - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.\n  - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.\n  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. If volume type is gp3 and throughput is not specified, the throughput will defaults to 125. When `null`, the `throughput` field will be omitted from the resulting object.\n  - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `main_volume` sub block.\n', args=[]),
       new(
         iops=null,
         kms_key_arn=null,
@@ -102,7 +120,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     root_volume:: {
-      '#new':: d.fn(help='\n`google.container_aws_cluster.control_plane.root_volume.new` constructs a new object with attributes and blocks configured for the `root_volume`\nTerraform sub block.\n\n\n\n**Args**:\n  - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.\n  - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.\n  - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.\n  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. When `null`, the `throughput` field will be omitted from the resulting object.\n  - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `root_volume` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_aws_cluster.control_plane.root_volume.new` constructs a new object with attributes and blocks configured for the `root_volume`\nTerraform sub block.\n\n\n\n**Args**:\n  - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.\n  - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.\n  - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.\n  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. If volume type is gp3 and throughput is not specified, the throughput will defaults to 125. When `null`, the `throughput` field will be omitted from the resulting object.\n  - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `root_volume` sub block.\n', args=[]),
       new(
         iops=null,
         kms_key_arn=null,
@@ -148,7 +166,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       vpc_id: vpc_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_aws_cluster.new` injects a new `google_container_aws_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_cluster` using the reference:\n\n    $._ref.google_container_aws_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_aws_cluster.new` injects a new `google_container_aws_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_cluster` using the reference:\n\n    $._ref.google_container_aws_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     aws_region,
@@ -156,6 +174,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name,
     annotations=null,
     authorization=null,
+    binary_authorization=null,
     control_plane=null,
     description=null,
     fleet=null,
@@ -170,6 +189,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       annotations=annotations,
       authorization=authorization,
       aws_region=aws_region,
+      binary_authorization=binary_authorization,
       control_plane=control_plane,
       description=description,
       fleet=fleet,
@@ -181,13 +201,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_aws_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_cluster`\nTerraform resource.\n\nUnlike [google.container_aws_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_aws_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_cluster`\nTerraform resource.\n\nUnlike [google.container_aws_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     aws_region,
     location,
     name,
     annotations=null,
     authorization=null,
+    binary_authorization=null,
     control_plane=null,
     description=null,
     fleet=null,
@@ -198,6 +219,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     annotations: annotations,
     authorization: authorization,
     aws_region: aws_region,
+    binary_authorization: binary_authorization,
     control_plane: control_plane,
     description: description,
     fleet: fleet,
@@ -259,6 +281,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withBinaryAuthorization':: d.fn(help='`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorization(resourceLabel, value): {
+    resource+: {
+      google_container_aws_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization: value,
+        },
+      },
+    },
+  },
+  '#withBinaryAuthorizationMixin':: d.fn(help='`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_container_aws_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
   withControlPlane(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_aws_node_pool.libsonnet b/4.x/_gen/resources/container_aws_node_pool.libsonnet
index bf7815fe..d9417e8f 100644
--- a/4.x/_gen/resources/container_aws_node_pool.libsonnet
+++ b/4.x/_gen/resources/container_aws_node_pool.libsonnet
@@ -68,7 +68,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     root_volume:: {
-      '#new':: d.fn(help='\n`google.container_aws_node_pool.config.root_volume.new` constructs a new object with attributes and blocks configured for the `root_volume`\nTerraform sub block.\n\n\n\n**Args**:\n  - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.\n  - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.\n  - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.\n  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. When `null`, the `throughput` field will be omitted from the resulting object.\n  - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `root_volume` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_aws_node_pool.config.root_volume.new` constructs a new object with attributes and blocks configured for the `root_volume`\nTerraform sub block.\n\n\n\n**Args**:\n  - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.\n  - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.\n  - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.\n  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. If volume type is gp3 and throughput is not specified, the throughput will defaults to 125. When `null`, the `throughput` field will be omitted from the resulting object.\n  - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `root_volume` sub block.\n', args=[]),
       new(
         iops=null,
         kms_key_arn=null,
@@ -120,7 +120,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       max_pods_per_node: max_pods_per_node,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_aws_node_pool.new` injects a new `google_container_aws_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_node_pool` using the reference:\n\n    $._ref.google_container_aws_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_aws_node_pool.new` injects a new `google_container_aws_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_node_pool` using the reference:\n\n    $._ref.google_container_aws_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_settings` (`list[obj]`): Optional. Update settings control the speed and disruption of the node pool update. When `null`, the `update_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.update_settings.new](#fn-update_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -135,6 +135,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_pods_constraint=null,
     project=null,
     timeouts=null,
+    update_settings=null,
     _meta={}
   ):: tf.withResource(
     type='google_container_aws_node_pool',
@@ -151,11 +152,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       subnet_id=subnet_id,
       timeouts=timeouts,
+      update_settings=update_settings,
       version=version
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_aws_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_node_pool`\nTerraform resource.\n\nUnlike [google.container_aws_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_aws_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_node_pool`\nTerraform resource.\n\nUnlike [google.container_aws_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_settings` (`list[obj]`): Optional. Update settings control the speed and disruption of the node pool update. When `null`, the `update_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.update_settings.new](#fn-update_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_node_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     location,
@@ -168,7 +170,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     management=null,
     max_pods_constraint=null,
     project=null,
-    timeouts=null
+    timeouts=null,
+    update_settings=null
   ):: std.prune(a={
     annotations: annotations,
     autoscaling: autoscaling,
@@ -181,6 +184,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     subnet_id: subnet_id,
     timeouts: timeouts,
+    update_settings: update_settings,
     version: version,
   }),
   timeouts:: {
@@ -195,6 +199,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  update_settings:: {
+    '#new':: d.fn(help='\n`google.container_aws_node_pool.update_settings.new` constructs a new object with attributes and blocks configured for the `update_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `surge_settings` (`list[obj]`): Optional. Settings for surge update. When `null`, the `surge_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.update_settings.surge_settings.new](#fn-update_settingssurge_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `update_settings` sub block.\n', args=[]),
+    new(
+      surge_settings=null
+    ):: std.prune(a={
+      surge_settings: surge_settings,
+    }),
+    surge_settings:: {
+      '#new':: d.fn(help='\n`google.container_aws_node_pool.update_settings.surge_settings.new` constructs a new object with attributes and blocks configured for the `surge_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_surge` (`number`): Optional. The maximum number of nodes that can be created beyond the current size of the node pool during the update process. When `null`, the `max_surge` field will be omitted from the resulting object.\n  - `max_unavailable` (`number`): Optional. The maximum number of nodes that can be simultaneously unavailable during the update process. A node is considered unavailable if its status is not Ready. When `null`, the `max_unavailable` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `surge_settings` sub block.\n', args=[]),
+      new(
+        max_surge=null,
+        max_unavailable=null
+      ):: std.prune(a={
+        max_surge: max_surge,
+        max_unavailable: max_unavailable,
+      }),
+    },
+  },
   '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
   withAnnotations(resourceLabel, value): {
     resource+: {
@@ -355,6 +377,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withUpdateSettings':: d.fn(help='`google.list[obj].withUpdateSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the update_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withUpdateSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `update_settings` field.\n', args=[]),
+  withUpdateSettings(resourceLabel, value): {
+    resource+: {
+      google_container_aws_node_pool+: {
+        [resourceLabel]+: {
+          update_settings: value,
+        },
+      },
+    },
+  },
+  '#withUpdateSettingsMixin':: d.fn(help='`google.list[obj].withUpdateSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the update_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withUpdateSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `update_settings` field.\n', args=[]),
+  withUpdateSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_container_aws_node_pool+: {
+        [resourceLabel]+: {
+          update_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withVersion':: d.fn(help='`google.string.withVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `version` field.\n', args=[]),
   withVersion(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_azure_cluster.libsonnet b/4.x/_gen/resources/container_azure_cluster.libsonnet
index 9d05996f..24a3a772 100644
--- a/4.x/_gen/resources/container_azure_cluster.libsonnet
+++ b/4.x/_gen/resources/container_azure_cluster.libsonnet
@@ -3,6 +3,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='container_azure_cluster', url='', help='`container_azure_cluster` represents the `google_container_azure_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   authorization:: {
+    admin_groups:: {
+      '#new':: d.fn(help='\n`google.container_azure_cluster.authorization.admin_groups.new` constructs a new object with attributes and blocks configured for the `admin_groups`\nTerraform sub block.\n\n\n\n**Args**:\n  - `group` (`string`): The name of the group, e.g. `my-group@domain.com`.\n\n**Returns**:\n  - An attribute object that represents the `admin_groups` sub block.\n', args=[]),
+      new(
+        group
+      ):: std.prune(a={
+        group: group,
+      }),
+    },
     admin_users:: {
       '#new':: d.fn(help='\n`google.container_azure_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. `my-gcp-id@gmail.com`.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
       new(
@@ -11,10 +19,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         username: username,
       }),
     },
-    '#new':: d.fn(help='\n`google.container_azure_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that can perform operations as a cluster admin. A new ClusterRoleBinding will be created to grant the cluster-admin ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_azure_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_groups` (`list[obj]`): Groups of users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the groups. Up to ten admin groups can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.admin_groups.new](#fn-authorizationadmin_groupsnew) constructor.\n  - `admin_users` (`list[obj]`): Users that can perform operations as a cluster admin. A new ClusterRoleBinding will be created to grant the cluster-admin ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
     new(
+      admin_groups=null,
       admin_users=null
     ):: std.prune(a={
+      admin_groups: admin_groups,
       admin_users: admin_users,
     }),
   },
@@ -126,7 +136,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       virtual_network_id: virtual_network_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_azure_cluster.new` injects a new `google_container_azure_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_cluster` using the reference:\n\n    $._ref.google_container_azure_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/\u0026lt;project-number\u0026gt;/locations/\u0026lt;region\u0026gt;/azureClients/\u0026lt;client-id\u0026gt;`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_azure_cluster.new` injects a new `google_container_azure_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_cluster` using the reference:\n\n    $._ref.google_container_azure_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/\u0026lt;project-number\u0026gt;/locations/\u0026lt;region\u0026gt;/azureClients/\u0026lt;client-id\u0026gt;`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     azure_region,
@@ -165,7 +175,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_azure_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_cluster`\nTerraform resource.\n\nUnlike [google.container_azure_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_azure_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_cluster`\nTerraform resource.\n\nUnlike [google.container_azure_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     azure_region,
     location,
diff --git a/4.x/_gen/resources/container_azure_node_pool.libsonnet b/4.x/_gen/resources/container_azure_node_pool.libsonnet
index c4fd5985..9c27dd99 100644
--- a/4.x/_gen/resources/container_azure_node_pool.libsonnet
+++ b/4.x/_gen/resources/container_azure_node_pool.libsonnet
@@ -13,14 +13,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   config:: {
-    '#new':: d.fn(help='\n`google.container_azure_node_pool.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `tags` (`obj`): Optional. A set of tags to apply to all underlying Azure resources for this node pool. This currently only includes Virtual Machine Scale Sets. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters. When `null`, the `tags` field will be omitted from the resulting object.\n  - `vm_size` (`string`): Optional. The Azure VM size name. Example: `Standard_DS2_v2`. See (/anthos/clusters/docs/azure/reference/supported-vms) for options. When unspecified, it defaults to `Standard_DS2_v2`. When `null`, the `vm_size` field will be omitted from the resulting object.\n  - `proxy_config` (`list[obj]`): Proxy configuration for outbound HTTP(S) traffic. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.proxy_config.new](#fn-configproxy_confignew) constructor.\n  - `root_volume` (`list[obj]`): Optional. Configuration related to the root volume provisioned for each node pool machine. When unspecified, it defaults to a 32-GiB Azure Disk. When `null`, the `root_volume` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.root_volume.new](#fn-configroot_volumenew) constructor.\n  - `ssh_config` (`list[obj]`): SSH configuration for how to access the node pool machines. When `null`, the `ssh_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.ssh_config.new](#fn-configssh_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_azure_node_pool.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): Optional. The initial labels assigned to nodes of this node pool. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `tags` (`obj`): Optional. A set of tags to apply to all underlying Azure resources for this node pool. This currently only includes Virtual Machine Scale Sets. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters. When `null`, the `tags` field will be omitted from the resulting object.\n  - `vm_size` (`string`): Optional. The Azure VM size name. Example: `Standard_DS2_v2`. See (/anthos/clusters/docs/azure/reference/supported-vms) for options. When unspecified, it defaults to `Standard_DS2_v2`. When `null`, the `vm_size` field will be omitted from the resulting object.\n  - `proxy_config` (`list[obj]`): Proxy configuration for outbound HTTP(S) traffic. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.proxy_config.new](#fn-configproxy_confignew) constructor.\n  - `root_volume` (`list[obj]`): Optional. Configuration related to the root volume provisioned for each node pool machine. When unspecified, it defaults to a 32-GiB Azure Disk. When `null`, the `root_volume` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.root_volume.new](#fn-configroot_volumenew) constructor.\n  - `ssh_config` (`list[obj]`): SSH configuration for how to access the node pool machines. When `null`, the `ssh_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.ssh_config.new](#fn-configssh_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
     new(
+      labels=null,
       proxy_config=null,
       root_volume=null,
       ssh_config=null,
       tags=null,
       vm_size=null
     ):: std.prune(a={
+      labels: labels,
       proxy_config: proxy_config,
       root_volume: root_volume,
       ssh_config: ssh_config,
@@ -70,7 +72,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       max_pods_per_node: max_pods_per_node,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_azure_node_pool.new` injects a new `google_container_azure_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_node_pool` using the reference:\n\n    $._ref.google_container_azure_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it\u0026#39;s a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_azure_node_pool.new` injects a new `google_container_azure_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_node_pool` using the reference:\n\n    $._ref.google_container_azure_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it\u0026#39;s a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -107,7 +109,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_azure_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_node_pool`\nTerraform resource.\n\nUnlike [google.container_azure_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it's a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_azure_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_node_pool`\nTerraform resource.\n\nUnlike [google.container_azure_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it's a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_node_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     location,
diff --git a/4.x/_gen/resources/container_cluster.libsonnet b/4.x/_gen/resources/container_cluster.libsonnet
index 06807bdc..1e925773 100644
--- a/4.x/_gen/resources/container_cluster.libsonnet
+++ b/4.x/_gen/resources/container_cluster.libsonnet
@@ -211,13 +211,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
-    '#new':: d.fn(help='\n`google.container_cluster.cluster_autoscaling.new` constructs a new object with attributes and blocks configured for the `cluster_autoscaling`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether node auto-provisioning is enabled. Resource limits for cpu and memory must be defined to enable node auto-provisioning. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `auto_provisioning_defaults` (`list[obj]`): Contains defaults for a node pool created by NAP. When `null`, the `auto_provisioning_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.auto_provisioning_defaults.new](#fn-cluster_autoscalingauto_provisioning_defaultsnew) constructor.\n  - `resource_limits` (`list[obj]`): Global constraints for machine resources in the cluster. Configuring the cpu and memory types is required if node auto-provisioning is enabled. These limits will apply to node pool autoscaling in addition to node auto-provisioning. When `null`, the `resource_limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.resource_limits.new](#fn-cluster_autoscalingresource_limitsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cluster_autoscaling` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.cluster_autoscaling.new` constructs a new object with attributes and blocks configured for the `cluster_autoscaling`\nTerraform sub block.\n\n\n\n**Args**:\n  - `autoscaling_profile` (`string`): Configuration options for the Autoscaling profile feature, which lets you choose whether the cluster autoscaler should optimize for resource utilization or resource availability when deciding to remove nodes from a cluster. Can be BALANCED or OPTIMIZE_UTILIZATION. Defaults to BALANCED. When `null`, the `autoscaling_profile` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Whether node auto-provisioning is enabled. Resource limits for cpu and memory must be defined to enable node auto-provisioning. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `auto_provisioning_defaults` (`list[obj]`): Contains defaults for a node pool created by NAP. When `null`, the `auto_provisioning_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.auto_provisioning_defaults.new](#fn-cluster_autoscalingauto_provisioning_defaultsnew) constructor.\n  - `resource_limits` (`list[obj]`): Global constraints for machine resources in the cluster. Configuring the cpu and memory types is required if node auto-provisioning is enabled. These limits will apply to node pool autoscaling in addition to node auto-provisioning. When `null`, the `resource_limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.resource_limits.new](#fn-cluster_autoscalingresource_limitsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cluster_autoscaling` sub block.\n', args=[]),
     new(
       auto_provisioning_defaults=null,
+      autoscaling_profile=null,
       enabled=null,
       resource_limits=null
     ):: std.prune(a={
       auto_provisioning_defaults: auto_provisioning_defaults,
+      autoscaling_profile: autoscaling_profile,
       enabled: enabled,
       resource_limits: resource_limits,
     }),
@@ -288,6 +290,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enabled_apis: enabled_apis,
     }),
   },
+  fleet:: {
+    '#new':: d.fn(help='\n`google.container_cluster.fleet.new` constructs a new object with attributes and blocks configured for the `fleet`\nTerraform sub block.\n\n\n\n**Args**:\n  - `project` (`string`): The Fleet host project of the cluster. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `fleet` sub block.\n', args=[]),
+    new(
+      project=null
+    ):: std.prune(a={
+      project: project,
+    }),
+  },
   gateway_api_config:: {
     '#new':: d.fn(help='\n`google.container_cluster.gateway_api_config.new` constructs a new object with attributes and blocks configured for the `gateway_api_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `channel` (`string`): The Gateway API release channel to use for Gateway API.\n\n**Returns**:\n  - An attribute object that represents the `gateway_api_config` sub block.\n', args=[]),
     new(
@@ -296,6 +306,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       channel: channel,
     }),
   },
+  identity_service_config:: {
+    '#new':: d.fn(help='\n`google.container_cluster.identity_service_config.new` constructs a new object with attributes and blocks configured for the `identity_service_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to enable the Identity Service component. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `identity_service_config` sub block.\n', args=[]),
+    new(
+      enabled=null
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
   ip_allocation_policy:: {
     additional_pod_ranges_config:: {
       '#new':: d.fn(help='\n`google.container_cluster.ip_allocation_policy.additional_pod_ranges_config.new` constructs a new object with attributes and blocks configured for the `additional_pod_ranges_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_range_names` (`list`): Name for pod secondary ipv4 range which has the actual range defined ahead.\n\n**Returns**:\n  - An attribute object that represents the `additional_pod_ranges_config` sub block.\n', args=[]),
@@ -469,7 +487,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   network_policy:: {
-    '#new':: d.fn(help='\n`google.container_cluster.network_policy.new` constructs a new object with attributes and blocks configured for the `network_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether network policy is enabled on the cluster.\n  - `provider` (`string`): The selected network policy provider. Defaults to PROVIDER_UNSPECIFIED. When `null`, the `provider` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `network_policy` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.network_policy.new` constructs a new object with attributes and blocks configured for the `network_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether network policy is enabled on the cluster.\n  - `provider` (`string`): The selected network policy provider. When `null`, the `provider` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `network_policy` sub block.\n', args=[]),
     new(
       enabled,
       provider=null
@@ -478,7 +496,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       provider: provider,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_cluster.new` injects a new `google_container_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_cluster` using the reference:\n\n    $._ref.google_container_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn\u0026#39;t work on \u0026#34;routes-based\u0026#34; clusters, clusters that don\u0026#39;t have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster\u0026#39;s default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you\u0026#39;re using google_container_node_pool objects with no default node pool, you\u0026#39;ll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster\u0026#39;s version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster\u0026#39;s nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster\u0026#39;s zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster\u0026#39;s zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it\u0026#39;s recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source\u0026#39;s version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you\u0026#39;re using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster\u0026#39;s instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster\u0026#39;s workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \u0026#34;ENCRYPTED\u0026#34;; \u0026#34;DECRYPTED\u0026#34;. key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say \u0026#34;these are the only node pools associated with this cluster\u0026#34;, use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the \u0026#34;UNSPECIFIED\u0026#34; channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_cluster.new` injects a new `google_container_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_cluster` using the reference:\n\n    $._ref.google_container_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn\u0026#39;t work on \u0026#34;routes-based\u0026#34; clusters, clusters that don\u0026#39;t have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster\u0026#39;s default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you\u0026#39;re using google_container_node_pool objects with no default node pool, you\u0026#39;ll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster\u0026#39;s version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster\u0026#39;s nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster\u0026#39;s zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster\u0026#39;s zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it\u0026#39;s recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source\u0026#39;s version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you\u0026#39;re using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster\u0026#39;s instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster\u0026#39;s workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \u0026#34;ENCRYPTED\u0026#34;; \u0026#34;DECRYPTED\u0026#34;. key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration of the cluster. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say \u0026#34;these are the only node pools associated with this cluster\u0026#34;, use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the \u0026#34;UNSPECIFIED\u0026#34; channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -494,10 +512,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     datapath_provider=null,
     default_max_pods_per_node=null,
     default_snat_status=null,
+    deletion_protection=null,
     description=null,
     dns_config=null,
     enable_autopilot=null,
-    enable_binary_authorization=null,
     enable_intranode_visibility=null,
     enable_k8s_beta_apis=null,
     enable_kubernetes_alpha=null,
@@ -505,7 +523,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_legacy_abac=null,
     enable_shielded_nodes=null,
     enable_tpu=null,
+    fleet=null,
     gateway_api_config=null,
+    identity_service_config=null,
     initial_node_count=null,
     ip_allocation_policy=null,
     location=null,
@@ -558,10 +578,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       datapath_provider=datapath_provider,
       default_max_pods_per_node=default_max_pods_per_node,
       default_snat_status=default_snat_status,
+      deletion_protection=deletion_protection,
       description=description,
       dns_config=dns_config,
       enable_autopilot=enable_autopilot,
-      enable_binary_authorization=enable_binary_authorization,
       enable_intranode_visibility=enable_intranode_visibility,
       enable_k8s_beta_apis=enable_k8s_beta_apis,
       enable_kubernetes_alpha=enable_kubernetes_alpha,
@@ -569,7 +589,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enable_legacy_abac=enable_legacy_abac,
       enable_shielded_nodes=enable_shielded_nodes,
       enable_tpu=enable_tpu,
+      fleet=fleet,
       gateway_api_config=gateway_api_config,
+      identity_service_config=identity_service_config,
       initial_node_count=initial_node_count,
       ip_allocation_policy=ip_allocation_policy,
       location=location,
@@ -609,7 +631,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_cluster`\nTerraform resource.\n\nUnlike [google.container_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster's default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you're using google_container_node_pool objects with no default node pool, you'll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster's version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster's instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the "UNSPECIFIED" channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_cluster`\nTerraform resource.\n\nUnlike [google.container_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster's default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you're using google_container_node_pool objects with no default node pool, you'll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster's version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster's instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration of the cluster. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the "UNSPECIFIED" channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     addons_config=null,
@@ -624,10 +646,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     datapath_provider=null,
     default_max_pods_per_node=null,
     default_snat_status=null,
+    deletion_protection=null,
     description=null,
     dns_config=null,
     enable_autopilot=null,
-    enable_binary_authorization=null,
     enable_intranode_visibility=null,
     enable_k8s_beta_apis=null,
     enable_kubernetes_alpha=null,
@@ -635,7 +657,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_legacy_abac=null,
     enable_shielded_nodes=null,
     enable_tpu=null,
+    fleet=null,
     gateway_api_config=null,
+    identity_service_config=null,
     initial_node_count=null,
     ip_allocation_policy=null,
     location=null,
@@ -684,10 +708,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     datapath_provider: datapath_provider,
     default_max_pods_per_node: default_max_pods_per_node,
     default_snat_status: default_snat_status,
+    deletion_protection: deletion_protection,
     description: description,
     dns_config: dns_config,
     enable_autopilot: enable_autopilot,
-    enable_binary_authorization: enable_binary_authorization,
     enable_intranode_visibility: enable_intranode_visibility,
     enable_k8s_beta_apis: enable_k8s_beta_apis,
     enable_kubernetes_alpha: enable_kubernetes_alpha,
@@ -695,7 +719,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_legacy_abac: enable_legacy_abac,
     enable_shielded_nodes: enable_shielded_nodes,
     enable_tpu: enable_tpu,
+    fleet: fleet,
     gateway_api_config: gateway_api_config,
+    identity_service_config: identity_service_config,
     initial_node_count: initial_node_count,
     ip_allocation_policy: ip_allocation_policy,
     location: location,
@@ -805,10 +831,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     linux_node_config:: {
-      '#new':: d.fn(help='\n`google.container_cluster.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_cluster.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
       new(
-        sysctls
+        cgroup_mode=null,
+        sysctls=null
       ):: std.prune(a={
+        cgroup_mode: cgroup_mode,
         sysctls: sysctls,
       }),
     },
@@ -820,7 +848,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         local_ssd_count: local_ssd_count,
       }),
     },
-    '#new':: d.fn(help='\n`google.container_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.taint.new](#fn-node_configtaintnew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
     new(
       advanced_machine_features=null,
       boot_disk_kms_key=null,
@@ -932,6 +960,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
+    taint:: {
+      '#new':: d.fn(help='\n`google.container_cluster.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Effect for taint.\n  - `key` (`string`): Key for taint.\n  - `value` (`string`): Value for taint.\n\n**Returns**:\n  - An attribute object that represents the `taint` sub block.\n', args=[]),
+      new(
+        effect,
+        key,
+        value
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
     workload_metadata_config:: {
       '#new':: d.fn(help='\n`google.container_cluster.node_config.workload_metadata_config.new` constructs a new object with attributes and blocks configured for the `workload_metadata_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Mode is the configuration for how to expose metadata to workloads running on the node.\n\n**Returns**:\n  - An attribute object that represents the `workload_metadata_config` sub block.\n', args=[]),
       new(
@@ -959,7 +999,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     management:: {
-      '#new':: d.fn(help='\n`google.container_cluster.node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_cluster.node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
       new(
         auto_repair=null,
         auto_upgrade=null
@@ -969,16 +1009,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     network_config:: {
-      '#new':: d.fn(help='\n`google.container_cluster.node_pool.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create_pod_range` (`bool`): Whether to create a new range for pod IPs in this node pool. Defaults are provided for pod_range and pod_ipv4_cidr_block if they are not specified. When `null`, the `create_pod_range` field will be omitted from the resulting object.\n  - `enable_private_nodes` (`bool`): Whether nodes have internal IP addresses only. When `null`, the `enable_private_nodes` field will be omitted from the resulting object.\n  - `pod_ipv4_cidr_block` (`string`): The IP address range for pod IPs in this node pool. Only applicable if create_pod_range is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) to pick a specific range to use. When `null`, the `pod_ipv4_cidr_block` field will be omitted from the resulting object.\n  - `pod_range` (`string`): The ID of the secondary range for pod IPs. If create_pod_range is true, this ID is used for the new range. If create_pod_range is false, uses an existing secondary range with this ID. When `null`, the `pod_range` field will be omitted from the resulting object.\n  - `pod_cidr_overprovision_config` (`list[obj]`): Configuration for node-pool level pod cidr overprovision. If not set, the cluster level setting will be inherited When `null`, the `pod_cidr_overprovision_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.network_config.pod_cidr_overprovision_config.new](#fn-node_poolnode_poolpod_cidr_overprovision_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+      network_performance_config:: {
+        '#new':: d.fn(help='\n`google.container_cluster.node_pool.network_config.network_performance_config.new` constructs a new object with attributes and blocks configured for the `network_performance_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `total_egress_bandwidth_tier` (`string`): Specifies the total network bandwidth tier for the NodePool.\n\n**Returns**:\n  - An attribute object that represents the `network_performance_config` sub block.\n', args=[]),
+        new(
+          total_egress_bandwidth_tier
+        ):: std.prune(a={
+          total_egress_bandwidth_tier: total_egress_bandwidth_tier,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.container_cluster.node_pool.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create_pod_range` (`bool`): Whether to create a new range for pod IPs in this node pool. Defaults are provided for pod_range and pod_ipv4_cidr_block if they are not specified. When `null`, the `create_pod_range` field will be omitted from the resulting object.\n  - `enable_private_nodes` (`bool`): Whether nodes have internal IP addresses only. When `null`, the `enable_private_nodes` field will be omitted from the resulting object.\n  - `pod_ipv4_cidr_block` (`string`): The IP address range for pod IPs in this node pool. Only applicable if create_pod_range is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) to pick a specific range to use. When `null`, the `pod_ipv4_cidr_block` field will be omitted from the resulting object.\n  - `pod_range` (`string`): The ID of the secondary range for pod IPs. If create_pod_range is true, this ID is used for the new range. If create_pod_range is false, uses an existing secondary range with this ID. When `null`, the `pod_range` field will be omitted from the resulting object.\n  - `network_performance_config` (`list[obj]`): Network bandwidth tier configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.network_config.network_performance_config.new](#fn-node_poolnode_poolnetwork_performance_confignew) constructor.\n  - `pod_cidr_overprovision_config` (`list[obj]`): Configuration for node-pool level pod cidr overprovision. If not set, the cluster level setting will be inherited When `null`, the `pod_cidr_overprovision_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.network_config.pod_cidr_overprovision_config.new](#fn-node_poolnode_poolpod_cidr_overprovision_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
       new(
         create_pod_range=null,
         enable_private_nodes=null,
+        network_performance_config=null,
         pod_cidr_overprovision_config=null,
         pod_ipv4_cidr_block=null,
         pod_range=null
       ):: std.prune(a={
         create_pod_range: create_pod_range,
         enable_private_nodes: enable_private_nodes,
+        network_performance_config: network_performance_config,
         pod_cidr_overprovision_config: pod_cidr_overprovision_config,
         pod_ipv4_cidr_block: pod_ipv4_cidr_block,
         pod_range: pod_range,
@@ -1094,10 +1144,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
       linux_node_config:: {
-        '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
         new(
-          sysctls
+          cgroup_mode=null,
+          sysctls=null
         ):: std.prune(a={
+          cgroup_mode: cgroup_mode,
           sysctls: sysctls,
         }),
       },
@@ -1109,7 +1161,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           local_ssd_count: local_ssd_count,
         }),
       },
-      '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.advanced_machine_features.new](#fn-node_poolnode_pooladvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.confidential_nodes.new](#fn-node_poolnode_poolconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_poolnode_poolephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.fast_socket.new](#fn-node_poolnode_poolfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gcfs_config.new](#fn-node_poolnode_poolgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gvnic.new](#fn-node_poolnode_poolgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.host_maintenance_policy.new](#fn-node_poolnode_poolhost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.kubelet_config.new](#fn-node_poolnode_poolkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.linux_node_config.new](#fn-node_poolnode_poollinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_poolnode_poollocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.reservation_affinity.new](#fn-node_poolnode_poolreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.shielded_instance_config.new](#fn-node_poolnode_poolshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.sole_tenant_config.new](#fn-node_poolnode_poolsole_tenant_confignew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.workload_metadata_config.new](#fn-node_poolnode_poolworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.advanced_machine_features.new](#fn-node_poolnode_pooladvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.confidential_nodes.new](#fn-node_poolnode_poolconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_poolnode_poolephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.fast_socket.new](#fn-node_poolnode_poolfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gcfs_config.new](#fn-node_poolnode_poolgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gvnic.new](#fn-node_poolnode_poolgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.host_maintenance_policy.new](#fn-node_poolnode_poolhost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.kubelet_config.new](#fn-node_poolnode_poolkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.linux_node_config.new](#fn-node_poolnode_poollinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_poolnode_poollocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.reservation_affinity.new](#fn-node_poolnode_poolreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.shielded_instance_config.new](#fn-node_poolnode_poolshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.sole_tenant_config.new](#fn-node_poolnode_poolsole_tenant_confignew) constructor.\n  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.taint.new](#fn-node_poolnode_pooltaintnew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.workload_metadata_config.new](#fn-node_poolnode_poolworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
       new(
         advanced_machine_features=null,
         boot_disk_kms_key=null,
@@ -1221,6 +1273,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           }),
         },
       },
+      taint:: {
+        '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Effect for taint.\n  - `key` (`string`): Key for taint.\n  - `value` (`string`): Value for taint.\n\n**Returns**:\n  - An attribute object that represents the `taint` sub block.\n', args=[]),
+        new(
+          effect,
+          key,
+          value
+        ):: std.prune(a={
+          effect: effect,
+          key: key,
+          value: value,
+        }),
+      },
       workload_metadata_config:: {
         '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.workload_metadata_config.new` constructs a new object with attributes and blocks configured for the `workload_metadata_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Mode is the configuration for how to expose metadata to workloads running on the node.\n\n**Returns**:\n  - An attribute object that represents the `workload_metadata_config` sub block.\n', args=[]),
         new(
@@ -1392,7 +1456,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   security_posture_config:: {
-    '#new':: d.fn(help='\n`google.container_cluster.security_posture_config.new` constructs a new object with attributes and blocks configured for the `security_posture_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC. When `null`, the `mode` field will be omitted from the resulting object.\n  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED and VULNERABILITY_BASIC. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `security_posture_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.security_posture_config.new` constructs a new object with attributes and blocks configured for the `security_posture_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC. When `null`, the `mode` field will be omitted from the resulting object.\n  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED, VULNERABILITY_BASIC and VULNERABILITY_ENTERPRISE. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `security_posture_config` sub block.\n', args=[]),
     new(
       mode=null,
       vulnerability_mode=null
@@ -1631,6 +1695,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDeletionProtection':: d.fn(help='`google.bool.withDeletionProtection` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the deletion_protection field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `deletion_protection` field.\n', args=[]),
+  withDeletionProtection(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          deletion_protection: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
@@ -1671,16 +1745,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#withEnableBinaryAuthorization':: d.fn(help='`google.bool.withEnableBinaryAuthorization` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_binary_authorization field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_binary_authorization` field.\n', args=[]),
-  withEnableBinaryAuthorization(resourceLabel, value): {
-    resource+: {
-      google_container_cluster+: {
-        [resourceLabel]+: {
-          enable_binary_authorization: value,
-        },
-      },
-    },
-  },
   '#withEnableIntranodeVisibility':: d.fn(help='`google.bool.withEnableIntranodeVisibility` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_intranode_visibility field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_intranode_visibility` field.\n', args=[]),
   withEnableIntranodeVisibility(resourceLabel, value): {
     resource+: {
@@ -1761,6 +1825,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withFleet':: d.fn(help='`google.list[obj].withFleet` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFleetMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet` field.\n', args=[]),
+  withFleet(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          fleet: value,
+        },
+      },
+    },
+  },
+  '#withFleetMixin':: d.fn(help='`google.list[obj].withFleetMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFleet](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet` field.\n', args=[]),
+  withFleetMixin(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          fleet+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withGatewayApiConfig':: d.fn(help='`google.list[obj].withGatewayApiConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gateway_api_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGatewayApiConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gateway_api_config` field.\n', args=[]),
   withGatewayApiConfig(resourceLabel, value): {
     resource+: {
@@ -1781,6 +1865,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIdentityServiceConfig':: d.fn(help='`google.list[obj].withIdentityServiceConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the identity_service_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIdentityServiceConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.\n', args=[]),
+  withIdentityServiceConfig(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          identity_service_config: value,
+        },
+      },
+    },
+  },
+  '#withIdentityServiceConfigMixin':: d.fn(help='`google.list[obj].withIdentityServiceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the identity_service_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIdentityServiceConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.\n', args=[]),
+  withIdentityServiceConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          identity_service_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withInitialNodeCount':: d.fn(help='`google.number.withInitialNodeCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the initial_node_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `initial_node_count` field.\n', args=[]),
   withInitialNodeCount(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_node_pool.libsonnet b/4.x/_gen/resources/container_node_pool.libsonnet
index 606793c4..8e404997 100644
--- a/4.x/_gen/resources/container_node_pool.libsonnet
+++ b/4.x/_gen/resources/container_node_pool.libsonnet
@@ -19,7 +19,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   management:: {
-    '#new':: d.fn(help='\n`google.container_node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
     new(
       auto_repair=null,
       auto_upgrade=null
@@ -29,16 +29,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   network_config:: {
-    '#new':: d.fn(help='\n`google.container_node_pool.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create_pod_range` (`bool`): Whether to create a new range for pod IPs in this node pool. Defaults are provided for pod_range and pod_ipv4_cidr_block if they are not specified. When `null`, the `create_pod_range` field will be omitted from the resulting object.\n  - `enable_private_nodes` (`bool`): Whether nodes have internal IP addresses only. When `null`, the `enable_private_nodes` field will be omitted from the resulting object.\n  - `pod_ipv4_cidr_block` (`string`): The IP address range for pod IPs in this node pool. Only applicable if create_pod_range is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) to pick a specific range to use. When `null`, the `pod_ipv4_cidr_block` field will be omitted from the resulting object.\n  - `pod_range` (`string`): The ID of the secondary range for pod IPs. If create_pod_range is true, this ID is used for the new range. If create_pod_range is false, uses an existing secondary range with this ID. When `null`, the `pod_range` field will be omitted from the resulting object.\n  - `pod_cidr_overprovision_config` (`list[obj]`): Configuration for node-pool level pod cidr overprovision. If not set, the cluster level setting will be inherited When `null`, the `pod_cidr_overprovision_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.network_config.pod_cidr_overprovision_config.new](#fn-network_configpod_cidr_overprovision_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    network_performance_config:: {
+      '#new':: d.fn(help='\n`google.container_node_pool.network_config.network_performance_config.new` constructs a new object with attributes and blocks configured for the `network_performance_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `total_egress_bandwidth_tier` (`string`): Specifies the total network bandwidth tier for the NodePool.\n\n**Returns**:\n  - An attribute object that represents the `network_performance_config` sub block.\n', args=[]),
+      new(
+        total_egress_bandwidth_tier
+      ):: std.prune(a={
+        total_egress_bandwidth_tier: total_egress_bandwidth_tier,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.container_node_pool.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create_pod_range` (`bool`): Whether to create a new range for pod IPs in this node pool. Defaults are provided for pod_range and pod_ipv4_cidr_block if they are not specified. When `null`, the `create_pod_range` field will be omitted from the resulting object.\n  - `enable_private_nodes` (`bool`): Whether nodes have internal IP addresses only. When `null`, the `enable_private_nodes` field will be omitted from the resulting object.\n  - `pod_ipv4_cidr_block` (`string`): The IP address range for pod IPs in this node pool. Only applicable if create_pod_range is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) to pick a specific range to use. When `null`, the `pod_ipv4_cidr_block` field will be omitted from the resulting object.\n  - `pod_range` (`string`): The ID of the secondary range for pod IPs. If create_pod_range is true, this ID is used for the new range. If create_pod_range is false, uses an existing secondary range with this ID. When `null`, the `pod_range` field will be omitted from the resulting object.\n  - `network_performance_config` (`list[obj]`): Network bandwidth tier configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.network_config.network_performance_config.new](#fn-network_confignetwork_performance_confignew) constructor.\n  - `pod_cidr_overprovision_config` (`list[obj]`): Configuration for node-pool level pod cidr overprovision. If not set, the cluster level setting will be inherited When `null`, the `pod_cidr_overprovision_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.network_config.pod_cidr_overprovision_config.new](#fn-network_configpod_cidr_overprovision_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
     new(
       create_pod_range=null,
       enable_private_nodes=null,
+      network_performance_config=null,
       pod_cidr_overprovision_config=null,
       pod_ipv4_cidr_block=null,
       pod_range=null
     ):: std.prune(a={
       create_pod_range: create_pod_range,
       enable_private_nodes: enable_private_nodes,
+      network_performance_config: network_performance_config,
       pod_cidr_overprovision_config: pod_cidr_overprovision_config,
       pod_ipv4_cidr_block: pod_ipv4_cidr_block,
       pod_range: pod_range,
@@ -207,10 +217,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     linux_node_config:: {
-      '#new':: d.fn(help='\n`google.container_node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
       new(
-        sysctls
+        cgroup_mode=null,
+        sysctls=null
       ):: std.prune(a={
+        cgroup_mode: cgroup_mode,
         sysctls: sysctls,
       }),
     },
@@ -222,7 +234,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         local_ssd_count: local_ssd_count,
       }),
     },
-    '#new':: d.fn(help='\n`google.container_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.taint.new](#fn-node_configtaintnew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
     new(
       advanced_machine_features=null,
       boot_disk_kms_key=null,
@@ -334,6 +346,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
+    taint:: {
+      '#new':: d.fn(help='\n`google.container_node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Effect for taint.\n  - `key` (`string`): Key for taint.\n  - `value` (`string`): Value for taint.\n\n**Returns**:\n  - An attribute object that represents the `taint` sub block.\n', args=[]),
+      new(
+        effect,
+        key,
+        value
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
     workload_metadata_config:: {
       '#new':: d.fn(help='\n`google.container_node_pool.node_config.workload_metadata_config.new` constructs a new object with attributes and blocks configured for the `workload_metadata_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Mode is the configuration for how to expose metadata to workloads running on the node.\n\n**Returns**:\n  - An attribute object that represents the `workload_metadata_config` sub block.\n', args=[]),
       new(
diff --git a/4.x/_gen/resources/data_catalog_taxonomy.libsonnet b/4.x/_gen/resources/data_catalog_taxonomy.libsonnet
index 2b60ce1e..39e8f169 100644
--- a/4.x/_gen/resources/data_catalog_taxonomy.libsonnet
+++ b/4.x/_gen/resources/data_catalog_taxonomy.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='data_catalog_taxonomy', url='', help='`data_catalog_taxonomy` represents the `google_data_catalog_taxonomy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data_catalog_taxonomy.new` injects a new `google_data_catalog_taxonomy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_catalog_taxonomy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_catalog_taxonomy` using the reference:\n\n    $._ref.google_data_catalog_taxonomy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_catalog_taxonomy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `activated_policy_types` (`list`): A list of policy types that are activated for this taxonomy. If not set,\ndefaults to an empty list. Possible values: [\u0026#34;POLICY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;FINE_GRAINED_ACCESS_CONTROL\u0026#34;] When `null`, the `activated_policy_types` field will be omitted from the resulting object.\n  - `description` (`string`): Description of this taxonomy. It must: contain only unicode characters,\ntabs, newlines, carriage returns and page breaks; and be at most 2000 bytes\nlong when encoded in UTF-8. If not set, defaults to an empty description. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User defined name of this taxonomy.\nIt must: contain only unicode letters, numbers, underscores, dashes\nand spaces; not start or end with spaces; and be at most 200 bytes\nlong when encoded in UTF-8.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Taxonomy location region. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_catalog_taxonomy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data_catalog_taxonomy.new` injects a new `google_data_catalog_taxonomy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_catalog_taxonomy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_catalog_taxonomy` using the reference:\n\n    $._ref.google_data_catalog_taxonomy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_catalog_taxonomy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `activated_policy_types` (`list`): A list of policy types that are activated for this taxonomy. If not set,\ndefaults to an empty list. Possible values: [\u0026#34;POLICY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;FINE_GRAINED_ACCESS_CONTROL\u0026#34;] When `null`, the `activated_policy_types` field will be omitted from the resulting object.\n  - `description` (`string`): Description of this taxonomy. It must: contain only unicode characters,\ntabs, newlines, carriage returns and page breaks; and be at most 2000 bytes\nlong when encoded in UTF-8. If not set, defaults to an empty description. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User defined name of this taxonomy.\nThe taxonomy display name must be unique within an organization.\nIt must: contain only unicode letters, numbers, underscores, dashes\nand spaces; not start or end with spaces; and be at most 200 bytes\nlong when encoded in UTF-8.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Taxonomy location region. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_catalog_taxonomy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data_catalog_taxonomy.newAttrs` constructs a new object with attributes and blocks configured for the `data_catalog_taxonomy`\nTerraform resource.\n\nUnlike [google.data_catalog_taxonomy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `activated_policy_types` (`list`): A list of policy types that are activated for this taxonomy. If not set,\ndefaults to an empty list. Possible values: ["POLICY_TYPE_UNSPECIFIED", "FINE_GRAINED_ACCESS_CONTROL"] When `null`, the `activated_policy_types` field will be omitted from the resulting object.\n  - `description` (`string`): Description of this taxonomy. It must: contain only unicode characters,\ntabs, newlines, carriage returns and page breaks; and be at most 2000 bytes\nlong when encoded in UTF-8. If not set, defaults to an empty description. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User defined name of this taxonomy.\nIt must: contain only unicode letters, numbers, underscores, dashes\nand spaces; not start or end with spaces; and be at most 200 bytes\nlong when encoded in UTF-8.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Taxonomy location region. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_catalog_taxonomy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_catalog_taxonomy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data_catalog_taxonomy.newAttrs` constructs a new object with attributes and blocks configured for the `data_catalog_taxonomy`\nTerraform resource.\n\nUnlike [google.data_catalog_taxonomy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `activated_policy_types` (`list`): A list of policy types that are activated for this taxonomy. If not set,\ndefaults to an empty list. Possible values: ["POLICY_TYPE_UNSPECIFIED", "FINE_GRAINED_ACCESS_CONTROL"] When `null`, the `activated_policy_types` field will be omitted from the resulting object.\n  - `description` (`string`): Description of this taxonomy. It must: contain only unicode characters,\ntabs, newlines, carriage returns and page breaks; and be at most 2000 bytes\nlong when encoded in UTF-8. If not set, defaults to an empty description. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User defined name of this taxonomy.\nThe taxonomy display name must be unique within an organization.\nIt must: contain only unicode letters, numbers, underscores, dashes\nand spaces; not start or end with spaces; and be at most 200 bytes\nlong when encoded in UTF-8.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Taxonomy location region. When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_catalog_taxonomy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_catalog_taxonomy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     activated_policy_types=null,
diff --git a/4.x/_gen/resources/data_fusion_instance.libsonnet b/4.x/_gen/resources/data_fusion_instance.libsonnet
index cc535cb0..6420f7bb 100644
--- a/4.x/_gen/resources/data_fusion_instance.libsonnet
+++ b/4.x/_gen/resources/data_fusion_instance.libsonnet
@@ -40,7 +40,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       network: network,
     }),
   },
-  '#new':: d.fn(help="\n`google.data_fusion_instance.new` injects a new `google_data_fusion_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_fusion_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_fusion_instance` using the reference:\n\n    $._ref.google_data_fusion_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_fusion_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVELOPER\u0026#34;]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data_fusion_instance.new` injects a new `google_data_fusion_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_fusion_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_fusion_instance` using the reference:\n\n    $._ref.google_data_fusion_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_fusion_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVELOPER\u0026#34;]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -91,7 +91,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data_fusion_instance.newAttrs` constructs a new object with attributes and blocks configured for the `data_fusion_instance`\nTerraform resource.\n\nUnlike [google.data_fusion_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: ["BASIC", "ENTERPRISE", "DEVELOPER"]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_fusion_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data_fusion_instance.newAttrs` constructs a new object with attributes and blocks configured for the `data_fusion_instance`\nTerraform resource.\n\nUnlike [google.data_fusion_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: ["BASIC", "ENTERPRISE", "DEVELOPER"]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_fusion_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     type,
diff --git a/4.x/_gen/resources/data_loss_prevention_job_trigger.libsonnet b/4.x/_gen/resources/data_loss_prevention_job_trigger.libsonnet
index 43285947..44366035 100644
--- a/4.x/_gen/resources/data_loss_prevention_job_trigger.libsonnet
+++ b/4.x/_gen/resources/data_loss_prevention_job_trigger.libsonnet
@@ -505,7 +505,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         },
       },
     },
-    '#new':: d.fn(help='\n`google.data_loss_prevention_job_trigger.inspect_job.new` constructs a new object with attributes and blocks configured for the `inspect_job`\nTerraform sub block.\n\n\n\n**Args**:\n  - `inspect_template_name` (`string`): The name of the template to run when this job is triggered. When `null`, the `inspect_template_name` field will be omitted from the resulting object.\n  - `actions` (`list[obj]`): A task to execute on the completion of a job. When `null`, the `actions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.actions.new](#fn-inspect_jobactionsnew) constructor.\n  - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.inspect_config.new](#fn-inspect_jobinspect_confignew) constructor.\n  - `storage_config` (`list[obj]`): Information on where to inspect When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.new](#fn-inspect_jobstorage_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `inspect_job` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.data_loss_prevention_job_trigger.inspect_job.new` constructs a new object with attributes and blocks configured for the `inspect_job`\nTerraform sub block.\n\n\n\n**Args**:\n  - `inspect_template_name` (`string`): The name of the template to run when this job is triggered. When `null`, the `inspect_template_name` field will be omitted from the resulting object.\n  - `actions` (`list[obj]`): Configuration block for the actions to execute on the completion of a job. Can be specified multiple times, but only one for each type. Each action block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html). When `null`, the `actions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.actions.new](#fn-inspect_jobactionsnew) constructor.\n  - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.inspect_config.new](#fn-inspect_jobinspect_confignew) constructor.\n  - `storage_config` (`list[obj]`): Information on where to inspect When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.new](#fn-inspect_jobstorage_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `inspect_job` sub block.\n', args=[]),
     new(
       actions=null,
       inspect_config=null,
@@ -672,7 +672,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           }),
         },
       },
-      '#new':: d.fn(help='\n`google.data_loss_prevention_job_trigger.inspect_job.storage_config.new` constructs a new object with attributes and blocks configured for the `storage_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `big_query_options` (`list[obj]`): Options defining BigQuery table and row identifiers. When `null`, the `big_query_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.big_query_options.new](#fn-inspect_jobinspect_jobbig_query_optionsnew) constructor.\n  - `cloud_storage_options` (`list[obj]`): Options defining a file or a set of files within a Google Cloud Storage bucket. When `null`, the `cloud_storage_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.cloud_storage_options.new](#fn-inspect_jobinspect_jobcloud_storage_optionsnew) constructor.\n  - `datastore_options` (`list[obj]`): Options defining a data set within Google Cloud Datastore. When `null`, the `datastore_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.datastore_options.new](#fn-inspect_jobinspect_jobdatastore_optionsnew) constructor.\n  - `hybrid_options` (`list[obj]`): Configuration to control jobs where the content being inspected is outside of Google Cloud Platform. When `null`, the `hybrid_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.hybrid_options.new](#fn-inspect_jobinspect_jobhybrid_optionsnew) constructor.\n  - `timespan_config` (`list[obj]`): Information on where to inspect When `null`, the `timespan_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.new](#fn-inspect_jobinspect_jobtimespan_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `storage_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.data_loss_prevention_job_trigger.inspect_job.storage_config.new` constructs a new object with attributes and blocks configured for the `storage_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `big_query_options` (`list[obj]`): Options defining BigQuery table and row identifiers. When `null`, the `big_query_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.big_query_options.new](#fn-inspect_jobinspect_jobbig_query_optionsnew) constructor.\n  - `cloud_storage_options` (`list[obj]`): Options defining a file or a set of files within a Google Cloud Storage bucket. When `null`, the `cloud_storage_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.cloud_storage_options.new](#fn-inspect_jobinspect_jobcloud_storage_optionsnew) constructor.\n  - `datastore_options` (`list[obj]`): Options defining a data set within Google Cloud Datastore. When `null`, the `datastore_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.datastore_options.new](#fn-inspect_jobinspect_jobdatastore_optionsnew) constructor.\n  - `hybrid_options` (`list[obj]`): Configuration to control jobs where the content being inspected is outside of Google Cloud Platform. When `null`, the `hybrid_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.hybrid_options.new](#fn-inspect_jobinspect_jobhybrid_optionsnew) constructor.\n  - `timespan_config` (`list[obj]`): Configuration of the timespan of the items to include in scanning When `null`, the `timespan_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.new](#fn-inspect_jobinspect_jobtimespan_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `storage_config` sub block.\n', args=[]),
       new(
         big_query_options=null,
         cloud_storage_options=null,
@@ -687,7 +687,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         timespan_config: timespan_config,
       }),
       timespan_config:: {
-        '#new':: d.fn(help='\n`google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.new` constructs a new object with attributes and blocks configured for the `timespan_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_auto_population_of_timespan_config` (`bool`): When the job is started by a JobTrigger we will automatically figure out a valid startTime to avoid\nscanning files that have not been modified since the last time the JobTrigger executed. This will\nbe based on the time of the execution of the last run of the JobTrigger. When `null`, the `enable_auto_population_of_timespan_config` field will be omitted from the resulting object.\n  - `end_time` (`string`): Exclude files or rows newer than this value. If set to zero, no upper time limit is applied. When `null`, the `end_time` field will be omitted from the resulting object.\n  - `start_time` (`string`): Exclude files or rows older than this value. When `null`, the `start_time` field will be omitted from the resulting object.\n  - `timestamp_field` (`list[obj]`): Information on where to inspect When `null`, the `timestamp_field` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.timestamp_field.new](#fn-inspect_jobinspect_jobstorage_configtimestamp_fieldnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `timespan_config` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.new` constructs a new object with attributes and blocks configured for the `timespan_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_auto_population_of_timespan_config` (`bool`): When the job is started by a JobTrigger we will automatically figure out a valid startTime to avoid\nscanning files that have not been modified since the last time the JobTrigger executed. This will\nbe based on the time of the execution of the last run of the JobTrigger or the timespan endTime\nused in the last run of the JobTrigger. When `null`, the `enable_auto_population_of_timespan_config` field will be omitted from the resulting object.\n  - `end_time` (`string`): Exclude files, tables, or rows newer than this value. If not set, no upper time limit is applied. When `null`, the `end_time` field will be omitted from the resulting object.\n  - `start_time` (`string`): Exclude files, tables, or rows older than this value. If not set, no lower time limit is applied. When `null`, the `start_time` field will be omitted from the resulting object.\n  - `timestamp_field` (`list[obj]`): Specification of the field containing the timestamp of scanned items. When `null`, the `timestamp_field` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.timestamp_field.new](#fn-inspect_jobinspect_jobstorage_configtimestamp_fieldnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `timespan_config` sub block.\n', args=[]),
         new(
           enable_auto_population_of_timespan_config=null,
           end_time=null,
diff --git a/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet b/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet
index d636b2ab..7117ec7e 100644
--- a/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet
+++ b/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet
@@ -160,7 +160,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.database_migration_service_connection_profile.new` injects a new `google_database_migration_service_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.database_migration_service_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.database_migration_service_connection_profile` using the reference:\n\n    $._ref.google_database_migration_service_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_database_migration_service_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.database_migration_service_connection_profile.new` injects a new `google_database_migration_service_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.database_migration_service_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.database_migration_service_connection_profile` using the reference:\n\n    $._ref.google_database_migration_service_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_database_migration_service_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     connection_profile_id,
@@ -170,6 +170,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     location=null,
     mysql=null,
+    oracle=null,
     postgresql=null,
     project=null,
     timeouts=null,
@@ -185,13 +186,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels=labels,
       location=location,
       mysql=mysql,
+      oracle=oracle,
       postgresql=postgresql,
       project=project,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.database_migration_service_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_connection_profile`\nTerraform resource.\n\nUnlike [google.database_migration_service_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_connection_profile` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.database_migration_service_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_connection_profile`\nTerraform resource.\n\nUnlike [google.database_migration_service_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_connection_profile` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     connection_profile_id,
     alloydb=null,
@@ -200,6 +202,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     location=null,
     mysql=null,
+    oracle=null,
     postgresql=null,
     project=null,
     timeouts=null
@@ -211,10 +214,77 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels: labels,
     location: location,
     mysql: mysql,
+    oracle: oracle,
     postgresql: postgresql,
     project: project,
     timeouts: timeouts,
   }),
+  oracle:: {
+    forward_ssh_connectivity:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new` constructs a new object with attributes and blocks configured for the `forward_ssh_connectivity`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hostname` (`string`): Required. Hostname for the SSH tunnel.\n  - `password` (`string`): Input only. SSH password. Only one of 'password' and 'private_key' can be configured. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): Port for the SSH tunnel, default value is 22.\n  - `private_key` (`string`): Input only. SSH private key. Only one of 'password' and 'private_key' can be configured. When `null`, the `private_key` field will be omitted from the resulting object.\n  - `username` (`string`): Required. Username for the SSH tunnel.\n\n**Returns**:\n  - An attribute object that represents the `forward_ssh_connectivity` sub block.\n', args=[]),
+      new(
+        hostname,
+        port,
+        username,
+        password=null,
+        private_key=null
+      ):: std.prune(a={
+        hostname: hostname,
+        password: password,
+        port: port,
+        private_key: private_key,
+        username: username,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.new` constructs a new object with attributes and blocks configured for the `oracle`\nTerraform sub block.\n\n\n\n**Args**:\n  - `database_service` (`string`): Required. Database service for the Oracle connection.\n  - `host` (`string`): Required. The IP or hostname of the source Oracle database.\n  - `password` (`string`): Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.\nThis field is not returned on request, and the value is encrypted when stored in Database Migration Service.\n  - `port` (`number`): Required. The network port of the source Oracle database.\n  - `username` (`string`): Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.\n  - `forward_ssh_connectivity` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new](#fn-oracleforward_ssh_connectivitynew) constructor.\n  - `private_connectivity` (`list[obj]`): Configuration for using a private network to communicate with the source database When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.private_connectivity.new](#fn-oracleprivate_connectivitynew) constructor.\n  - `ssl` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `ssl` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.ssl.new](#fn-oraclesslnew) constructor.\n  - `static_service_ip_connectivity` (`list[obj]`): This object has no nested fields.\n\nStatic IP address connectivity configured on service project. When `null`, the `static_service_ip_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new](#fn-oraclestatic_service_ip_connectivitynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oracle` sub block.\n', args=[]),
+    new(
+      database_service,
+      host,
+      password,
+      port,
+      username,
+      forward_ssh_connectivity=null,
+      private_connectivity=null,
+      ssl=null,
+      static_service_ip_connectivity=null
+    ):: std.prune(a={
+      database_service: database_service,
+      forward_ssh_connectivity: forward_ssh_connectivity,
+      host: host,
+      password: password,
+      port: port,
+      private_connectivity: private_connectivity,
+      ssl: ssl,
+      static_service_ip_connectivity: static_service_ip_connectivity,
+      username: username,
+    }),
+    private_connectivity:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.private_connectivity.new` constructs a new object with attributes and blocks configured for the `private_connectivity`\nTerraform sub block.\n\n\n\n**Args**:\n  - `private_connection` (`string`): Required. The resource name (URI) of the private connection.\n\n**Returns**:\n  - An attribute object that represents the `private_connectivity` sub block.\n', args=[]),
+      new(
+        private_connection
+      ):: std.prune(a={
+        private_connection: private_connection,
+      }),
+    },
+    ssl:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.ssl.new` constructs a new object with attributes and blocks configured for the `ssl`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ca_certificate` (`string`): Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate.\nThe replica will use this certificate to verify it's connecting to the right host.\n  - `client_certificate` (`string`): Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.\nIf this field is used then the 'clientKey' field is mandatory When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate.\nIf this field is used then the 'clientCertificate' field is mandatory. When `null`, the `client_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ssl` sub block.\n', args=[]),
+      new(
+        ca_certificate,
+        client_certificate=null,
+        client_key=null
+      ):: std.prune(a={
+        ca_certificate: ca_certificate,
+        client_certificate: client_certificate,
+        client_key: client_key,
+      }),
+    },
+    static_service_ip_connectivity:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new` constructs a new object with attributes and blocks configured for the `static_service_ip_connectivity`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `static_service_ip_connectivity` sub block.\n', args=[]),
+      new(
+
+      ):: std.prune(a={}),
+    },
+  },
   postgresql:: {
     '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.postgresql.new` constructs a new object with attributes and blocks configured for the `postgresql`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cloud_sql_id` (`string`): If the source is a Cloud SQL database, use this field to provide the Cloud SQL instance ID of the source. When `null`, the `cloud_sql_id` field will be omitted from the resulting object.\n  - `host` (`string`): Required. The IP or hostname of the source MySQL database.\n  - `password` (`string`): Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.\nThis field is not returned on request, and the value is encrypted when stored in Database Migration Service.\n  - `port` (`number`): Required. The network port of the source MySQL database.\n  - `username` (`string`): Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.\n  - `ssl` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `ssl` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.ssl.new](#fn-postgresqlsslnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `postgresql` sub block.\n', args=[]),
     new(
@@ -357,6 +427,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withOracle':: d.fn(help='`google.list[obj].withOracle` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the oracle field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withOracleMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `oracle` field.\n', args=[]),
+  withOracle(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_connection_profile+: {
+        [resourceLabel]+: {
+          oracle: value,
+        },
+      },
+    },
+  },
+  '#withOracleMixin':: d.fn(help='`google.list[obj].withOracleMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the oracle field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withOracle](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `oracle` field.\n', args=[]),
+  withOracleMixin(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_connection_profile+: {
+        [resourceLabel]+: {
+          oracle+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withPostgresql':: d.fn(help='`google.list[obj].withPostgresql` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the postgresql field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPostgresqlMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `postgresql` field.\n', args=[]),
   withPostgresql(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/database_migration_service_private_connection.libsonnet b/4.x/_gen/resources/database_migration_service_private_connection.libsonnet
new file mode 100644
index 00000000..34d54ff4
--- /dev/null
+++ b/4.x/_gen/resources/database_migration_service_private_connection.libsonnet
@@ -0,0 +1,160 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='database_migration_service_private_connection', url='', help='`database_migration_service_private_connection` represents the `google_database_migration_service_private_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.database_migration_service_private_connection.new` injects a new `google_database_migration_service_private_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.database_migration_service_private_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.database_migration_service_private_connection` using the reference:\n\n    $._ref.google_database_migration_service_private_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_database_migration_service_private_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween databasemigrationservice and the consumer\u0026#39;s VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    private_connection_id,
+    display_name=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    vpc_peering_config=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_database_migration_service_private_connection',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      display_name=display_name,
+      labels=labels,
+      location=location,
+      private_connection_id=private_connection_id,
+      project=project,
+      timeouts=timeouts,
+      vpc_peering_config=vpc_peering_config
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.database_migration_service_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_private_connection`\nTerraform resource.\n\nUnlike [google.database_migration_service_private_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween databasemigrationservice and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_private_connection` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    private_connection_id,
+    display_name=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    vpc_peering_config=null
+  ):: std.prune(a={
+    display_name: display_name,
+    labels: labels,
+    location: location,
+    private_connection_id: private_connection_id,
+    project: project,
+    timeouts: timeouts,
+    vpc_peering_config: vpc_peering_config,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.database_migration_service_private_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  vpc_peering_config:: {
+    '#new':: d.fn(help='\n`google.database_migration_service_private_connection.vpc_peering_config.new` constructs a new object with attributes and blocks configured for the `vpc_peering_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `subnet` (`string`): A free subnet for peering. (CIDR of /29)\n  - `vpc_name` (`string`): Fully qualified name of the VPC that Database Migration Service will peer to.\nFormat: projects/{project}/global/{networks}/{name}\n\n**Returns**:\n  - An attribute object that represents the `vpc_peering_config` sub block.\n', args=[]),
+    new(
+      subnet,
+      vpc_name
+    ):: std.prune(a={
+      subnet: subnet,
+      vpc_name: vpc_name,
+    }),
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withPrivateConnectionId':: d.fn(help='`google.string.withPrivateConnectionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the private_connection_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `private_connection_id` field.\n', args=[]),
+  withPrivateConnectionId(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          private_connection_id: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVpcPeeringConfig':: d.fn(help='`google.list[obj].withVpcPeeringConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_peering_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVpcPeeringConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.\n', args=[]),
+  withVpcPeeringConfig(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          vpc_peering_config: value,
+        },
+      },
+    },
+  },
+  '#withVpcPeeringConfigMixin':: d.fn(help='`google.list[obj].withVpcPeeringConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_peering_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVpcPeeringConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.\n', args=[]),
+  withVpcPeeringConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          vpc_peering_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/dataflow_job.libsonnet b/4.x/_gen/resources/dataflow_job.libsonnet
index 264d9413..3bc69ccd 100644
--- a/4.x/_gen/resources/dataflow_job.libsonnet
+++ b/4.x/_gen/resources/dataflow_job.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dataflow_job', url='', help='`dataflow_job` represents the `google_dataflow_job` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.dataflow_job.new` injects a new `google_dataflow_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataflow_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataflow_job` using the reference:\n\n    $._ref.google_dataflow_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataflow_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is [\u0026#34;enable_stackdriver_agent_metrics\u0026#34;]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are \u0026#34;WORKER_IP_PUBLIC\u0026#34; or \u0026#34;WORKER_IP_PRIVATE\u0026#34;. When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, \u0026#34;default\u0026#34; will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of \u0026#34;drain\u0026#34; or \u0026#34;cancel\u0026#34;. Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form \u0026#34;regions/REGION/subnetworks/SUBNETWORK\u0026#34;. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataflow_job.new` injects a new `google_dataflow_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataflow_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataflow_job` using the reference:\n\n    $._ref.google_dataflow_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataflow_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is [\u0026#34;enable_stackdriver_agent_metrics\u0026#34;]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are \u0026#34;WORKER_IP_PUBLIC\u0026#34; or \u0026#34;WORKER_IP_PRIVATE\u0026#34;. When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, \u0026#34;default\u0026#34; will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of \u0026#34;drain\u0026#34; or \u0026#34;cancel\u0026#34;. Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form \u0026#34;regions/REGION/subnetworks/SUBNETWORK\u0026#34;. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -55,7 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataflow_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataflow_job`\nTerraform resource.\n\nUnlike [google.dataflow_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, "default" will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of "drain" or "cancel". Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK". When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataflow_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataflow_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataflow_job`\nTerraform resource.\n\nUnlike [google.dataflow_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, "default" will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of "drain" or "cancel". Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK". When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataflow_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     temp_gcs_location,
diff --git a/4.x/_gen/resources/dataplex_asset.libsonnet b/4.x/_gen/resources/dataplex_asset.libsonnet
index e4cc4e31..62704c05 100644
--- a/4.x/_gen/resources/dataplex_asset.libsonnet
+++ b/4.x/_gen/resources/dataplex_asset.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       schedule: schedule,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_asset.new` injects a new `google_dataplex_asset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_asset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_asset` using the reference:\n\n    $._ref.google_dataplex_asset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_asset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_asset.new` injects a new `google_dataplex_asset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_asset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_asset` using the reference:\n\n    $._ref.google_dataplex_asset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_asset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataplex_zone,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_asset.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_asset`\nTerraform resource.\n\nUnlike [google.dataplex_asset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_asset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_asset.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_asset`\nTerraform resource.\n\nUnlike [google.dataplex_asset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_asset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataplex_zone,
     lake,
diff --git a/4.x/_gen/resources/dataplex_datascan.libsonnet b/4.x/_gen/resources/dataplex_datascan.libsonnet
index 60ee5e3a..ac8fd773 100644
--- a/4.x/_gen/resources/dataplex_datascan.libsonnet
+++ b/4.x/_gen/resources/dataplex_datascan.libsonnet
@@ -232,7 +232,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.dataplex_datascan.new` injects a new `google_dataplex_datascan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan` using the reference:\n\n    $._ref.google_dataplex_datascan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_datascan.new` injects a new `google_dataplex_datascan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan` using the reference:\n\n    $._ref.google_dataplex_datascan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     data_scan_id,
@@ -265,7 +265,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan`\nTerraform resource.\n\nUnlike [google.dataplex_datascan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan`\nTerraform resource.\n\nUnlike [google.dataplex_datascan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     data_scan_id,
     location,
diff --git a/4.x/_gen/resources/dataplex_lake.libsonnet b/4.x/_gen/resources/dataplex_lake.libsonnet
index c5c8c53b..8d41b08c 100644
--- a/4.x/_gen/resources/dataplex_lake.libsonnet
+++ b/4.x/_gen/resources/dataplex_lake.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       service: service,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_lake.new` injects a new `google_dataplex_lake` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_lake.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_lake` using the reference:\n\n    $._ref.google_dataplex_lake.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_lake.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_lake.new` injects a new `google_dataplex_lake` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_lake.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_lake` using the reference:\n\n    $._ref.google_dataplex_lake.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_lake.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_lake.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_lake`\nTerraform resource.\n\nUnlike [google.dataplex_lake.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_lake` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_lake.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_lake`\nTerraform resource.\n\nUnlike [google.dataplex_lake.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_lake` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/dataplex_task.libsonnet b/4.x/_gen/resources/dataplex_task.libsonnet
index abc79f26..d4edbf58 100644
--- a/4.x/_gen/resources/dataplex_task.libsonnet
+++ b/4.x/_gen/resources/dataplex_task.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       service_account: service_account,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_task.new` injects a new `google_dataplex_task` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_task.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_task` using the reference:\n\n    $._ref.google_dataplex_task.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_task.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_task.new` injects a new `google_dataplex_task` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_task.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_task` using the reference:\n\n    $._ref.google_dataplex_task.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_task.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     description=null,
@@ -53,7 +53,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_task.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_task`\nTerraform resource.\n\nUnlike [google.dataplex_task.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_task` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_task.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_task`\nTerraform resource.\n\nUnlike [google.dataplex_task.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_task` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     description=null,
     display_name=null,
diff --git a/4.x/_gen/resources/dataplex_zone.libsonnet b/4.x/_gen/resources/dataplex_zone.libsonnet
index 35760ae7..39418e42 100644
--- a/4.x/_gen/resources/dataplex_zone.libsonnet
+++ b/4.x/_gen/resources/dataplex_zone.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       schedule: schedule,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_zone.new` injects a new `google_dataplex_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_zone` using the reference:\n\n    $._ref.google_dataplex_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_zone.new` injects a new `google_dataplex_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_zone` using the reference:\n\n    $._ref.google_dataplex_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     lake,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_zone`\nTerraform resource.\n\nUnlike [google.dataplex_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_zone` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_zone`\nTerraform resource.\n\nUnlike [google.dataplex_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_zone` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     lake,
     location,
diff --git a/4.x/_gen/resources/dataproc_cluster.libsonnet b/4.x/_gen/resources/dataproc_cluster.libsonnet
index 8bfbf4eb..619828aa 100644
--- a/4.x/_gen/resources/dataproc_cluster.libsonnet
+++ b/4.x/_gen/resources/dataproc_cluster.libsonnet
@@ -11,6 +11,64 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         policy_uri: policy_uri,
       }),
     },
+    auxiliary_node_groups:: {
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.auxiliary_node_groups.new` constructs a new object with attributes and blocks configured for the `auxiliary_node_groups`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_group_id` (`string`): A node group ID. Generated if not specified. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), and hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of from 3 to 33 characters. When `null`, the `node_group_id` field will be omitted from the resulting object.\n  - `node_group` (`list[obj]`): Node group configuration. When `null`, the `node_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.new](#fn-cluster_configcluster_confignode_groupnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `auxiliary_node_groups` sub block.\n', args=[]),
+      new(
+        node_group=null,
+        node_group_id=null
+      ):: std.prune(a={
+        node_group: node_group,
+        node_group_id: node_group_id,
+      }),
+      node_group:: {
+        '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.new` constructs a new object with attributes and blocks configured for the `node_group`\nTerraform sub block.\n\n\n\n**Args**:\n  - `roles` (`list`): Node group roles.\n  - `node_group_config` (`list[obj]`): The node group instance group configuration. When `null`, the `node_group_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.new](#fn-cluster_configcluster_configauxiliary_node_groupsnode_group_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_group` sub block.\n', args=[]),
+        new(
+          roles,
+          node_group_config=null
+        ):: std.prune(a={
+          node_group_config: node_group_config,
+          roles: roles,
+        }),
+        node_group_config:: {
+          accelerators:: {
+            '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators.new` constructs a new object with attributes and blocks configured for the `accelerators`\nTerraform sub block.\n\n\n\n**Args**:\n  - `accelerator_count` (`number`): The number of the accelerator cards of this type exposed to this instance. Often restricted to one of 1, 2, 4, or 8.\n  - `accelerator_type` (`string`): The short name of the accelerator type to expose to this instance. For example, nvidia-tesla-k80.\n\n**Returns**:\n  - An attribute object that represents the `accelerators` sub block.\n', args=[]),
+            new(
+              accelerator_count,
+              accelerator_type
+            ):: std.prune(a={
+              accelerator_count: accelerator_count,
+              accelerator_type: accelerator_type,
+            }),
+          },
+          disk_config:: {
+            '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config.new` constructs a new object with attributes and blocks configured for the `disk_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard". When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `num_local_ssds` (`number`): The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0. When `null`, the `num_local_ssds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `disk_config` sub block.\n', args=[]),
+            new(
+              boot_disk_size_gb=null,
+              boot_disk_type=null,
+              num_local_ssds=null
+            ):: std.prune(a={
+              boot_disk_size_gb: boot_disk_size_gb,
+              boot_disk_type: boot_disk_type,
+              num_local_ssds: num_local_ssds,
+            }),
+          },
+          '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.new` constructs a new object with attributes and blocks configured for the `node_group_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the auxiliary node group. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of auxiliary nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators.new](#fn-cluster_configcluster_configauxiliary_node_groupsnode_groupacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config.new](#fn-cluster_configcluster_configauxiliary_node_groupsnode_groupdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_group_config` sub block.\n', args=[]),
+          new(
+            accelerators=null,
+            disk_config=null,
+            machine_type=null,
+            min_cpu_platform=null,
+            num_instances=null
+          ):: std.prune(a={
+            accelerators: accelerators,
+            disk_config: disk_config,
+            machine_type: machine_type,
+            min_cpu_platform: min_cpu_platform,
+            num_instances: num_instances,
+          }),
+        },
+      },
+    },
     dataproc_metric_config:: {
       metrics:: {
         '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.dataproc_metric_config.metrics.new` constructs a new object with attributes and blocks configured for the `metrics`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metric_overrides` (`list`): Specify one or more [available OSS metrics] (https://cloud.google.com/dataproc/docs/guides/monitoring#available_oss_metrics) to collect. When `null`, the `metric_overrides` field will be omitted from the resulting object.\n  - `metric_source` (`string`): A source for the collection of Dataproc OSS metrics (see [available OSS metrics] (https://cloud.google.com//dataproc/docs/guides/monitoring#available_oss_metrics)).\n\n**Returns**:\n  - An attribute object that represents the `metrics` sub block.\n', args=[]),
@@ -148,7 +206,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           num_local_ssds: num_local_ssds,
         }),
       },
-      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.master_config.new` constructs a new object with attributes and blocks configured for the `master_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `master_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.master_config.new` constructs a new object with attributes and blocks configured for the `master_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of master nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `master_config` sub block.\n', args=[]),
       new(
         accelerators=null,
         disk_config=null,
@@ -173,9 +231,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         dataproc_metastore_service: dataproc_metastore_service,
       }),
     },
-    '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.new` constructs a new object with attributes and blocks configured for the `cluster_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `staging_bucket` (`string`): The Cloud Storage staging bucket used to stage files, such as Hadoop jars, between client machines and the cluster. Note: If you don't explicitly specify a staging_bucket then GCP will auto create / assign one for you. However, you are not guaranteed an auto generated bucket which is solely dedicated to your cluster; it may be shared with other clusters in the same region/zone also choosing to use the auto generation option. When `null`, the `staging_bucket` field will be omitted from the resulting object.\n  - `temp_bucket` (`string`): The Cloud Storage temp bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. Note: If you don't explicitly specify a temp_bucket then GCP will auto create / assign one for you. When `null`, the `temp_bucket` field will be omitted from the resulting object.\n  - `autoscaling_config` (`list[obj]`): The autoscaling policy config associated with the cluster. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.autoscaling_config.new](#fn-cluster_configautoscaling_confignew) constructor.\n  - `dataproc_metric_config` (`list[obj]`): The config for Dataproc metrics. When `null`, the `dataproc_metric_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.dataproc_metric_config.new](#fn-cluster_configdataproc_metric_confignew) constructor.\n  - `encryption_config` (`list[obj]`): The Customer managed encryption keys settings for the cluster. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.encryption_config.new](#fn-cluster_configencryption_confignew) constructor.\n  - `endpoint_config` (`list[obj]`): The config settings for port access on the cluster. Structure defined below. When `null`, the `endpoint_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.endpoint_config.new](#fn-cluster_configendpoint_confignew) constructor.\n  - `gce_cluster_config` (`list[obj]`): Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster. When `null`, the `gce_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.gce_cluster_config.new](#fn-cluster_configgce_cluster_confignew) constructor.\n  - `initialization_action` (`list[obj]`): Commands to execute on each node after config is completed. You can specify multiple versions of these. When `null`, the `initialization_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.initialization_action.new](#fn-cluster_configinitialization_actionnew) constructor.\n  - `lifecycle_config` (`list[obj]`): The settings for auto deletion cluster schedule. When `null`, the `lifecycle_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.lifecycle_config.new](#fn-cluster_configlifecycle_confignew) constructor.\n  - `master_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.\n  - `metastore_config` (`list[obj]`): Specifies a Metastore configuration. When `null`, the `metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.metastore_config.new](#fn-cluster_configmetastore_confignew) constructor.\n  - `preemptible_worker_config` (`list[obj]`): The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster. When `null`, the `preemptible_worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.new](#fn-cluster_configpreemptible_worker_confignew) constructor.\n  - `security_config` (`list[obj]`): Security related configuration. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.security_config.new](#fn-cluster_configsecurity_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the cluster. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.software_config.new](#fn-cluster_configsoftware_confignew) constructor.\n  - `worker_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cluster_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.new` constructs a new object with attributes and blocks configured for the `cluster_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `staging_bucket` (`string`): The Cloud Storage staging bucket used to stage files, such as Hadoop jars, between client machines and the cluster. Note: If you don't explicitly specify a staging_bucket then GCP will auto create / assign one for you. However, you are not guaranteed an auto generated bucket which is solely dedicated to your cluster; it may be shared with other clusters in the same region/zone also choosing to use the auto generation option. When `null`, the `staging_bucket` field will be omitted from the resulting object.\n  - `temp_bucket` (`string`): The Cloud Storage temp bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. Note: If you don't explicitly specify a temp_bucket then GCP will auto create / assign one for you. When `null`, the `temp_bucket` field will be omitted from the resulting object.\n  - `autoscaling_config` (`list[obj]`): The autoscaling policy config associated with the cluster. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.autoscaling_config.new](#fn-cluster_configautoscaling_confignew) constructor.\n  - `auxiliary_node_groups` (`list[obj]`): The node group settings. When `null`, the `auxiliary_node_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.new](#fn-cluster_configauxiliary_node_groupsnew) constructor.\n  - `dataproc_metric_config` (`list[obj]`): The config for Dataproc metrics. When `null`, the `dataproc_metric_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.dataproc_metric_config.new](#fn-cluster_configdataproc_metric_confignew) constructor.\n  - `encryption_config` (`list[obj]`): The Customer managed encryption keys settings for the cluster. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.encryption_config.new](#fn-cluster_configencryption_confignew) constructor.\n  - `endpoint_config` (`list[obj]`): The config settings for port access on the cluster. Structure defined below. When `null`, the `endpoint_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.endpoint_config.new](#fn-cluster_configendpoint_confignew) constructor.\n  - `gce_cluster_config` (`list[obj]`): Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster. When `null`, the `gce_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.gce_cluster_config.new](#fn-cluster_configgce_cluster_confignew) constructor.\n  - `initialization_action` (`list[obj]`): Commands to execute on each node after config is completed. You can specify multiple versions of these. When `null`, the `initialization_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.initialization_action.new](#fn-cluster_configinitialization_actionnew) constructor.\n  - `lifecycle_config` (`list[obj]`): The settings for auto deletion cluster schedule. When `null`, the `lifecycle_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.lifecycle_config.new](#fn-cluster_configlifecycle_confignew) constructor.\n  - `master_config` (`list[obj]`): The Compute Engine config settings for the cluster's master instance. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.\n  - `metastore_config` (`list[obj]`): Specifies a Metastore configuration. When `null`, the `metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.metastore_config.new](#fn-cluster_configmetastore_confignew) constructor.\n  - `preemptible_worker_config` (`list[obj]`): The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster. When `null`, the `preemptible_worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.new](#fn-cluster_configpreemptible_worker_confignew) constructor.\n  - `security_config` (`list[obj]`): Security related configuration. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.security_config.new](#fn-cluster_configsecurity_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the cluster. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.software_config.new](#fn-cluster_configsoftware_confignew) constructor.\n  - `worker_config` (`list[obj]`): The Compute Engine config settings for the cluster's worker instances. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cluster_config` sub block.\n', args=[]),
     new(
       autoscaling_config=null,
+      auxiliary_node_groups=null,
       dataproc_metric_config=null,
       encryption_config=null,
       endpoint_config=null,
@@ -192,6 +251,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       worker_config=null
     ):: std.prune(a={
       autoscaling_config: autoscaling_config,
+      auxiliary_node_groups: auxiliary_node_groups,
       dataproc_metric_config: dataproc_metric_config,
       encryption_config: encryption_config,
       endpoint_config: endpoint_config,
@@ -220,13 +280,33 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           num_local_ssds: num_local_ssds,
         }),
       },
-      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.new` constructs a new object with attributes and blocks configured for the `preemptible_worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_instances` (`number`): Specifies the number of preemptible nodes to create. Defaults to 0. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `preemptibility` (`string`): Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE. When `null`, the `preemptibility` field will be omitted from the resulting object.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preemptible_worker_config` sub block.\n', args=[]),
+      instance_flexibility_policy:: {
+        instance_selection_list:: {
+          '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new` constructs a new object with attributes and blocks configured for the `instance_selection_list`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_types` (`list`): Full machine-type names, e.g. "n1-standard-16". When `null`, the `machine_types` field will be omitted from the resulting object.\n  - `rank` (`number`): Preference of this instance selection. Lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference. When `null`, the `rank` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `instance_selection_list` sub block.\n', args=[]),
+          new(
+            machine_types=null,
+            rank=null
+          ):: std.prune(a={
+            machine_types: machine_types,
+            rank: rank,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new` constructs a new object with attributes and blocks configured for the `instance_flexibility_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `instance_selection_list` (`list[obj]`): List of instance selection options that the group will use when creating new VMs. When `null`, the `instance_selection_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new](#fn-cluster_configcluster_configpreemptible_worker_configinstance_selection_listnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `instance_flexibility_policy` sub block.\n', args=[]),
+        new(
+          instance_selection_list=null
+        ):: std.prune(a={
+          instance_selection_list: instance_selection_list,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.new` constructs a new object with attributes and blocks configured for the `preemptible_worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_instances` (`number`): Specifies the number of preemptible nodes to create. Defaults to 0. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `preemptibility` (`string`): Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE. When `null`, the `preemptibility` field will be omitted from the resulting object.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n  - `instance_flexibility_policy` (`list[obj]`): Instance flexibility Policy allowing a mixture of VM shapes and provisioning models. When `null`, the `instance_flexibility_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new](#fn-cluster_configcluster_configinstance_flexibility_policynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preemptible_worker_config` sub block.\n', args=[]),
       new(
         disk_config=null,
+        instance_flexibility_policy=null,
         num_instances=null,
         preemptibility=null
       ):: std.prune(a={
         disk_config: disk_config,
+        instance_flexibility_policy: instance_flexibility_policy,
         num_instances: num_instances,
         preemptibility: preemptibility,
       }),
@@ -310,13 +390,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           num_local_ssds: num_local_ssds,
         }),
       },
-      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.worker_config.new` constructs a new object with attributes and blocks configured for the `worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `worker_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.worker_config.new` constructs a new object with attributes and blocks configured for the `worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `min_num_instances` (`number`): The minimum number of primary worker instances to create. When `null`, the `min_num_instances` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `worker_config` sub block.\n', args=[]),
       new(
         accelerators=null,
         disk_config=null,
         image_uri=null,
         machine_type=null,
         min_cpu_platform=null,
+        min_num_instances=null,
         num_instances=null
       ):: std.prune(a={
         accelerators: accelerators,
@@ -324,11 +405,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         image_uri: image_uri,
         machine_type: machine_type,
         min_cpu_platform: min_cpu_platform,
+        min_num_instances: min_num_instances,
         num_instances: num_instances,
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.dataproc_cluster.new` injects a new `google_dataproc_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_cluster` using the reference:\n\n    $._ref.google_dataproc_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_cluster.new` injects a new `google_dataproc_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_cluster` using the reference:\n\n    $._ref.google_dataproc_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -355,7 +437,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_cluster`\nTerraform resource.\n\nUnlike [google.dataproc_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_cluster`\nTerraform resource.\n\nUnlike [google.dataproc_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     cluster_config=null,
diff --git a/4.x/_gen/resources/dataproc_job.libsonnet b/4.x/_gen/resources/dataproc_job.libsonnet
index 0b16f451..858545b7 100644
--- a/4.x/_gen/resources/dataproc_job.libsonnet
+++ b/4.x/_gen/resources/dataproc_job.libsonnet
@@ -50,7 +50,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       script_variables: script_variables,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataproc_job.new` injects a new `google_dataproc_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_job` using the reference:\n\n    $._ref.google_dataproc_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_job.new` injects a new `google_dataproc_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_job` using the reference:\n\n    $._ref.google_dataproc_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     force_delete=null,
@@ -91,7 +91,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_job`\nTerraform resource.\n\nUnlike [google.dataproc_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_job`\nTerraform resource.\n\nUnlike [google.dataproc_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     force_delete=null,
     hadoop_config=null,
diff --git a/4.x/_gen/resources/dataproc_metastore_service.libsonnet b/4.x/_gen/resources/dataproc_metastore_service.libsonnet
index 23e35d52..c54b9091 100644
--- a/4.x/_gen/resources/dataproc_metastore_service.libsonnet
+++ b/4.x/_gen/resources/dataproc_metastore_service.libsonnet
@@ -11,6 +11,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   hive_metastore_config:: {
+    auxiliary_versions:: {
+      '#new':: d.fn(help='\n`google.dataproc_metastore_service.hive_metastore_config.auxiliary_versions.new` constructs a new object with attributes and blocks configured for the `auxiliary_versions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `config_overrides` (`obj`): A mapping of Hive metastore configuration key-value pairs to apply to the auxiliary Hive metastore (configured in hive-site.xml) in addition to the primary version's overrides.\nIf keys are present in both the auxiliary version's overrides and the primary version's overrides, the value from the auxiliary version's overrides takes precedence. When `null`, the `config_overrides` field will be omitted from the resulting object.\n  - `key` (`string`): Set the `key` field on the resulting object.\n  - `version` (`string`): The Hive metastore version of the auxiliary service. It must be less than the primary Hive metastore service's version.\n\n**Returns**:\n  - An attribute object that represents the `auxiliary_versions` sub block.\n', args=[]),
+      new(
+        key,
+        version,
+        config_overrides=null
+      ):: std.prune(a={
+        config_overrides: config_overrides,
+        key: key,
+        version: version,
+      }),
+    },
     kerberos_config:: {
       keytab:: {
         '#new':: d.fn(help='\n`google.dataproc_metastore_service.hive_metastore_config.kerberos_config.keytab.new` constructs a new object with attributes and blocks configured for the `keytab`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cloud_secret` (`string`): The relative resource name of a Secret Manager secret version, in the following form:\n\n"projects/{projectNumber}/secrets/{secret_id}/versions/{version_id}".\n\n**Returns**:\n  - An attribute object that represents the `keytab` sub block.\n', args=[]),
@@ -31,13 +43,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         principal: principal,
       }),
     },
-    '#new':: d.fn(help='\n`google.dataproc_metastore_service.hive_metastore_config.new` constructs a new object with attributes and blocks configured for the `hive_metastore_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `config_overrides` (`obj`): A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml).\nThe mappings override system defaults (some keys cannot be overridden) When `null`, the `config_overrides` field will be omitted from the resulting object.\n  - `version` (`string`): The Hive metastore schema version.\n  - `kerberos_config` (`list[obj]`): Information used to configure the Hive metastore service as a service principal in a Kerberos realm. When `null`, the `kerberos_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.kerberos_config.new](#fn-hive_metastore_configkerberos_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `hive_metastore_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.dataproc_metastore_service.hive_metastore_config.new` constructs a new object with attributes and blocks configured for the `hive_metastore_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `config_overrides` (`obj`): A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml).\nThe mappings override system defaults (some keys cannot be overridden) When `null`, the `config_overrides` field will be omitted from the resulting object.\n  - `endpoint_protocol` (`string`): The protocol to use for the metastore service endpoint. If unspecified, defaults to 'THRIFT'. Default value: "THRIFT" Possible values: ["THRIFT", "GRPC"] When `null`, the `endpoint_protocol` field will be omitted from the resulting object.\n  - `version` (`string`): The Hive metastore schema version.\n  - `auxiliary_versions` (`list[obj]`): A mapping of Hive metastore version to the auxiliary version configuration.\nWhen specified, a secondary Hive metastore service is created along with the primary service.\nAll auxiliary versions must be less than the service's primary version.\nThe key is the auxiliary service name and it must match the regular expression a-z?.\nThis means that the first character must be a lowercase letter, and all the following characters must be hyphens, lowercase letters, or digits, except the last character, which cannot be a hyphen. When `null`, the `auxiliary_versions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.auxiliary_versions.new](#fn-hive_metastore_configauxiliary_versionsnew) constructor.\n  - `kerberos_config` (`list[obj]`): Information used to configure the Hive metastore service as a service principal in a Kerberos realm. When `null`, the `kerberos_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.kerberos_config.new](#fn-hive_metastore_configkerberos_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `hive_metastore_config` sub block.\n', args=[]),
     new(
       version,
+      auxiliary_versions=null,
       config_overrides=null,
+      endpoint_protocol=null,
       kerberos_config=null
     ):: std.prune(a={
+      auxiliary_versions: auxiliary_versions,
       config_overrides: config_overrides,
+      endpoint_protocol: endpoint_protocol,
       kerberos_config: kerberos_config,
       version: version,
     }),
@@ -52,6 +68,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       hour_of_day: hour_of_day,
     }),
   },
+  metadata_integration:: {
+    data_catalog_config:: {
+      '#new':: d.fn(help='\n`google.dataproc_metastore_service.metadata_integration.data_catalog_config.new` constructs a new object with attributes and blocks configured for the `data_catalog_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Defines whether the metastore metadata should be synced to Data Catalog. The default value is to disable syncing metastore metadata to Data Catalog.\n\n**Returns**:\n  - An attribute object that represents the `data_catalog_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dataproc_metastore_service.metadata_integration.new` constructs a new object with attributes and blocks configured for the `metadata_integration`\nTerraform sub block.\n\n\n\n**Args**:\n  - `data_catalog_config` (`list[obj]`): The integration config for the Data Catalog service. When `null`, the `data_catalog_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.metadata_integration.data_catalog_config.new](#fn-metadata_integrationdata_catalog_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metadata_integration` sub block.\n', args=[]),
+    new(
+      data_catalog_config=null
+    ):: std.prune(a={
+      data_catalog_config: data_catalog_config,
+    }),
+  },
   network_config:: {
     consumers:: {
       '#new':: d.fn(help='\n`google.dataproc_metastore_service.network_config.consumers.new` constructs a new object with attributes and blocks configured for the `consumers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `subnetwork` (`string`): The subnetwork of the customer project from which an IP address is reserved and used as the Dataproc Metastore service's endpoint.\nIt is accessible to hosts in the subnet and to all hosts in a subnet in the same region and same network.\nThere must be at least one IP address available in the subnet's primary range. The subnet is specified in the following form:\n'projects/{projectNumber}/regions/{region_id}/subnetworks/{subnetwork_id}\n\n**Returns**:\n  - An attribute object that represents the `consumers` sub block.\n', args=[]),
@@ -68,7 +100,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       consumers: consumers,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataproc_metastore_service.new` injects a new `google_dataproc_metastore_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_metastore_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_metastore_service` using the reference:\n\n    $._ref.google_dataproc_metastore_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_metastore_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: \u0026#34;MYSQL\u0026#34; Possible values: [\u0026#34;MYSQL\u0026#34;, \u0026#34;SPANNER\u0026#34;] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to \u0026#39;STABLE\u0026#39;. Default value: \u0026#34;STABLE\u0026#34; Possible values: [\u0026#34;CANARY\u0026#34;, \u0026#34;STABLE\u0026#34;] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: [\u0026#34;DEVELOPER\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the \u0026#39;SPANNER\u0026#39; database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_metastore_service.new` injects a new `google_dataproc_metastore_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_metastore_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_metastore_service` using the reference:\n\n    $._ref.google_dataproc_metastore_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_metastore_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: \u0026#34;MYSQL\u0026#34; Possible values: [\u0026#34;MYSQL\u0026#34;, \u0026#34;SPANNER\u0026#34;] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to \u0026#39;STABLE\u0026#39;. Default value: \u0026#34;STABLE\u0026#34; Possible values: [\u0026#34;CANARY\u0026#34;, \u0026#34;STABLE\u0026#34;] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: [\u0026#34;DEVELOPER\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the \u0026#39;SPANNER\u0026#39; database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `metadata_integration` (`list[obj]`): The setting that defines how metastore metadata should be integrated with external services and systems. When `null`, the `metadata_integration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.metadata_integration.new](#fn-metadata_integrationnew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     service_id,
@@ -78,6 +110,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     location=null,
     maintenance_window=null,
+    metadata_integration=null,
     network=null,
     network_config=null,
     port=null,
@@ -98,6 +131,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels=labels,
       location=location,
       maintenance_window=maintenance_window,
+      metadata_integration=metadata_integration,
       network=network,
       network_config=network_config,
       port=port,
@@ -111,7 +145,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_metastore_service.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_metastore_service`\nTerraform resource.\n\nUnlike [google.dataproc_metastore_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to 'STABLE'. Default value: "STABLE" Possible values: ["CANARY", "STABLE"] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: ["DEVELOPER", "ENTERPRISE"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the 'SPANNER' database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_metastore_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_metastore_service.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_metastore_service`\nTerraform resource.\n\nUnlike [google.dataproc_metastore_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to 'STABLE'. Default value: "STABLE" Possible values: ["CANARY", "STABLE"] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: ["DEVELOPER", "ENTERPRISE"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the 'SPANNER' database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `metadata_integration` (`list[obj]`): The setting that defines how metastore metadata should be integrated with external services and systems. When `null`, the `metadata_integration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.metadata_integration.new](#fn-metadata_integrationnew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_metastore_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     service_id,
     database_type=null,
@@ -120,6 +154,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     location=null,
     maintenance_window=null,
+    metadata_integration=null,
     network=null,
     network_config=null,
     port=null,
@@ -136,6 +171,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels: labels,
     location: location,
     maintenance_window: maintenance_window,
+    metadata_integration: metadata_integration,
     network: network,
     network_config: network_config,
     port: port,
@@ -267,6 +303,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withMetadataIntegration':: d.fn(help='`google.list[obj].withMetadataIntegration` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the metadata_integration field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMetadataIntegrationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `metadata_integration` field.\n', args=[]),
+  withMetadataIntegration(resourceLabel, value): {
+    resource+: {
+      google_dataproc_metastore_service+: {
+        [resourceLabel]+: {
+          metadata_integration: value,
+        },
+      },
+    },
+  },
+  '#withMetadataIntegrationMixin':: d.fn(help='`google.list[obj].withMetadataIntegrationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the metadata_integration field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMetadataIntegration](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `metadata_integration` field.\n', args=[]),
+  withMetadataIntegrationMixin(resourceLabel, value): {
+    resource+: {
+      google_dataproc_metastore_service+: {
+        [resourceLabel]+: {
+          metadata_integration+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withNetwork':: d.fn(help='`google.string.withNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `network` field.\n', args=[]),
   withNetwork(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dataproc_workflow_template.libsonnet b/4.x/_gen/resources/dataproc_workflow_template.libsonnet
index 3200ec9f..f40d471a 100644
--- a/4.x/_gen/resources/dataproc_workflow_template.libsonnet
+++ b/4.x/_gen/resources/dataproc_workflow_template.libsonnet
@@ -290,7 +290,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.dataproc_workflow_template.new` injects a new `google_dataproc_workflow_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_workflow_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_workflow_template` using the reference:\n\n    $._ref.google_dataproc_workflow_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_workflow_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes (\u0026#34;600s\u0026#34;) to 24 hours (\u0026#34;86400s\u0026#34;). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_workflow_template.new` injects a new `google_dataproc_workflow_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_workflow_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_workflow_template` using the reference:\n\n    $._ref.google_dataproc_workflow_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_workflow_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes (\u0026#34;600s\u0026#34;) to 24 hours (\u0026#34;86400s\u0026#34;). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -321,7 +321,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_workflow_template.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_workflow_template`\nTerraform resource.\n\nUnlike [google.dataproc_workflow_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_workflow_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_workflow_template.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_workflow_template`\nTerraform resource.\n\nUnlike [google.dataproc_workflow_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_workflow_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -740,13 +740,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   timeouts:: {
-    '#new':: d.fn(help='\n`google.dataproc_workflow_template.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.dataproc_workflow_template.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withDagTimeout':: d.fn(help='`google.string.withDagTimeout` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the dag_timeout field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `dag_timeout` field.\n', args=[]),
diff --git a/4.x/_gen/resources/datastream_connection_profile.libsonnet b/4.x/_gen/resources/datastream_connection_profile.libsonnet
index 79e05847..9a6a446a 100644
--- a/4.x/_gen/resources/datastream_connection_profile.libsonnet
+++ b/4.x/_gen/resources/datastream_connection_profile.libsonnet
@@ -62,7 +62,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.datastream_connection_profile.new` injects a new `google_datastream_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_connection_profile` using the reference:\n\n    $._ref.google_datastream_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.datastream_connection_profile.new` injects a new `google_datastream_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_connection_profile` using the reference:\n\n    $._ref.google_datastream_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     connection_profile_id,
@@ -99,7 +99,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.datastream_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_connection_profile`\nTerraform resource.\n\nUnlike [google.datastream_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_connection_profile` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.datastream_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_connection_profile`\nTerraform resource.\n\nUnlike [google.datastream_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_connection_profile` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     connection_profile_id,
     display_name,
diff --git a/4.x/_gen/resources/datastream_private_connection.libsonnet b/4.x/_gen/resources/datastream_private_connection.libsonnet
index 01f5a870..55fb939a 100644
--- a/4.x/_gen/resources/datastream_private_connection.libsonnet
+++ b/4.x/_gen/resources/datastream_private_connection.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='datastream_private_connection', url='', help='`datastream_private_connection` represents the `google_datastream_private_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.datastream_private_connection.new` injects a new `google_datastream_private_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_private_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_private_connection` using the reference:\n\n    $._ref.google_datastream_private_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_private_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer\u0026#39;s VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.datastream_private_connection.new` injects a new `google_datastream_private_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_private_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_private_connection` using the reference:\n\n    $._ref.google_datastream_private_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_private_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer\u0026#39;s VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.datastream_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_private_connection`\nTerraform resource.\n\nUnlike [google.datastream_private_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_private_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.datastream_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_private_connection`\nTerraform resource.\n\nUnlike [google.datastream_private_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_private_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     location,
@@ -46,13 +46,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     vpc_peering_config: vpc_peering_config,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.datastream_private_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.datastream_private_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   vpc_peering_config:: {
diff --git a/4.x/_gen/resources/datastream_stream.libsonnet b/4.x/_gen/resources/datastream_stream.libsonnet
index 8b5f1a6a..e9d70e41 100644
--- a/4.x/_gen/resources/datastream_stream.libsonnet
+++ b/4.x/_gen/resources/datastream_stream.libsonnet
@@ -232,7 +232,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       gcs_destination_config: gcs_destination_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.datastream_stream.new` injects a new `google_datastream_stream` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_stream.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_stream` using the reference:\n\n    $._ref.google_datastream_stream.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_stream.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to \u0026#39;RUNNING\u0026#39; to start the stream, and \u0026#39;PAUSED\u0026#39; to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream\u0026#39;s objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream\u0026#39;s objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.datastream_stream.new` injects a new `google_datastream_stream` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_stream.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_stream` using the reference:\n\n    $._ref.google_datastream_stream.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_stream.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to \u0026#39;RUNNING\u0026#39; to start the stream, and \u0026#39;PAUSED\u0026#39; to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream\u0026#39;s objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream\u0026#39;s objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -267,7 +267,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.datastream_stream.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_stream`\nTerraform resource.\n\nUnlike [google.datastream_stream.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream's objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream's objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_stream` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.datastream_stream.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_stream`\nTerraform resource.\n\nUnlike [google.datastream_stream.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream's objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream's objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_stream` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     location,
diff --git a/4.x/_gen/resources/dialogflow_cx_agent.libsonnet b/4.x/_gen/resources/dialogflow_cx_agent.libsonnet
index 04cb0fca..df947c2a 100644
--- a/4.x/_gen/resources/dialogflow_cx_agent.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_agent.libsonnet
@@ -2,70 +2,136 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_agent', url='', help='`dialogflow_cx_agent` represents the `google_dialogflow_cx_agent` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.dialogflow_cx_agent.new` injects a new `google_dialogflow_cx_agent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_agent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_agent` using the reference:\n\n    $._ref.google_dialogflow_cx_agent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_agent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `avatar_uri` (`string`): The URI of the agent\u0026#39;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~\u0026gt; **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don\u0026#39;t need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/securitySettings/\u0026lt;Security Settings ID\u0026gt;. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  advanced_settings:: {
+    audio_export_gcs_destination:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.\nFormat: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `audio_export_gcs_destination` sub block.\n', args=[]),
+      new(
+        uri=null
+      ):: std.prune(a={
+        uri: uri,
+      }),
+    },
+    dtmf_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+      new(
+        enabled=null,
+        finish_digit=null,
+        max_digits=null
+      ):: std.prune(a={
+        enabled: enabled,
+        finish_digit: finish_digit,
+        max_digits: max_digits,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_agent.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:\n* Agent level\n* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+    new(
+      audio_export_gcs_destination=null,
+      dtmf_settings=null
+    ):: std.prune(a={
+      audio_export_gcs_destination: audio_export_gcs_destination,
+      dtmf_settings: dtmf_settings,
+    }),
+  },
+  git_integration_settings:: {
+    github_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_agent.git_integration_settings.github_settings.new` constructs a new object with attributes and blocks configured for the `github_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_token` (`string`): The access token used to authenticate the access to the GitHub repository. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `branches` (`list`): A list of branches configured to be used from Dialogflow. When `null`, the `branches` field will be omitted from the resulting object.\n  - `display_name` (`string`): The unique repository display name for the GitHub repository. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `repository_uri` (`string`): The GitHub repository URI related to the agent. When `null`, the `repository_uri` field will be omitted from the resulting object.\n  - `tracking_branch` (`string`): The branch of the GitHub repository tracked for this agent. When `null`, the `tracking_branch` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `github_settings` sub block.\n', args=[]),
+      new(
+        access_token=null,
+        branches=null,
+        display_name=null,
+        repository_uri=null,
+        tracking_branch=null
+      ):: std.prune(a={
+        access_token: access_token,
+        branches: branches,
+        display_name: display_name,
+        repository_uri: repository_uri,
+        tracking_branch: tracking_branch,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_agent.git_integration_settings.new` constructs a new object with attributes and blocks configured for the `git_integration_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `github_settings` (`list[obj]`): Settings of integration with GitHub. When `null`, the `github_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.github_settings.new](#fn-git_integration_settingsgithub_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `git_integration_settings` sub block.\n', args=[]),
+    new(
+      github_settings=null
+    ):: std.prune(a={
+      github_settings: github_settings,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.dialogflow_cx_agent.new` injects a new `google_dialogflow_cx_agent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_agent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_agent` using the reference:\n\n    $._ref.google_dialogflow_cx_agent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_agent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `avatar_uri` (`string`): The URI of the agent\u0026#39;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~\u0026gt; **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don\u0026#39;t need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/securitySettings/\u0026lt;Security Settings ID\u0026gt;. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent-\u0026gt;Flow-\u0026gt;Page-\u0026gt;Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     default_language_code,
     display_name,
     location,
     time_zone,
+    advanced_settings=null,
     avatar_uri=null,
     description=null,
     enable_spell_correction=null,
     enable_stackdriver_logging=null,
+    git_integration_settings=null,
     project=null,
     security_settings=null,
     speech_to_text_settings=null,
     supported_language_codes=null,
+    text_to_speech_settings=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
     type='google_dialogflow_cx_agent',
     label=resourceLabel,
     attrs=self.newAttrs(
+      advanced_settings=advanced_settings,
       avatar_uri=avatar_uri,
       default_language_code=default_language_code,
       description=description,
       display_name=display_name,
       enable_spell_correction=enable_spell_correction,
       enable_stackdriver_logging=enable_stackdriver_logging,
+      git_integration_settings=git_integration_settings,
       location=location,
       project=project,
       security_settings=security_settings,
       speech_to_text_settings=speech_to_text_settings,
       supported_language_codes=supported_language_codes,
+      text_to_speech_settings=text_to_speech_settings,
       time_zone=time_zone,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_agent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_agent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_agent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `avatar_uri` (`string`): The URI of the agent's avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~> **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don't need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/<Project ID>/locations/<Location ID>/securitySettings/<Security Settings ID>. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_agent` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_agent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_agent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_agent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `avatar_uri` (`string`): The URI of the agent's avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~> **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don't need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/<Project ID>/locations/<Location ID>/securitySettings/<Security Settings ID>. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_agent` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     default_language_code,
     display_name,
     location,
     time_zone,
+    advanced_settings=null,
     avatar_uri=null,
     description=null,
     enable_spell_correction=null,
     enable_stackdriver_logging=null,
+    git_integration_settings=null,
     project=null,
     security_settings=null,
     speech_to_text_settings=null,
     supported_language_codes=null,
+    text_to_speech_settings=null,
     timeouts=null
   ):: std.prune(a={
+    advanced_settings: advanced_settings,
     avatar_uri: avatar_uri,
     default_language_code: default_language_code,
     description: description,
     display_name: display_name,
     enable_spell_correction: enable_spell_correction,
     enable_stackdriver_logging: enable_stackdriver_logging,
+    git_integration_settings: git_integration_settings,
     location: location,
     project: project,
     security_settings: security_settings,
     speech_to_text_settings: speech_to_text_settings,
     supported_language_codes: supported_language_codes,
+    text_to_speech_settings: text_to_speech_settings,
     time_zone: time_zone,
     timeouts: timeouts,
   }),
@@ -77,6 +143,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enable_speech_adaptation: enable_speech_adaptation,
     }),
   },
+  text_to_speech_settings:: {
+    '#new':: d.fn(help='\n`google.dialogflow_cx_agent.text_to_speech_settings.new` constructs a new object with attributes and blocks configured for the `text_to_speech_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `synthesize_speech_configs` (`string`): Configuration of how speech should be synthesized, mapping from [language](https://cloud.google.com/dialogflow/cx/docs/reference/language) to [SynthesizeSpeechConfig](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents#synthesizespeechconfig).\nThese settings affect:\n* The phone gateway synthesize configuration set via Agent.text_to_speech_settings.\n* How speech is synthesized when invoking session APIs. 'Agent.text_to_speech_settings' only applies if 'OutputAudioConfig.synthesize_speech_config' is not specified. When `null`, the `synthesize_speech_configs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `text_to_speech_settings` sub block.\n', args=[]),
+    new(
+      synthesize_speech_configs=null
+    ):: std.prune(a={
+      synthesize_speech_configs: synthesize_speech_configs,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.dialogflow_cx_agent.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -89,6 +163,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAdvancedSettings':: d.fn(help='`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          advanced_settings: value,
+        },
+      },
+    },
+  },
+  '#withAdvancedSettingsMixin':: d.fn(help='`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          advanced_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withAvatarUri':: d.fn(help='`google.string.withAvatarUri` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the avatar_uri field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `avatar_uri` field.\n', args=[]),
   withAvatarUri(resourceLabel, value): {
     resource+: {
@@ -149,6 +243,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withGitIntegrationSettings':: d.fn(help='`google.list[obj].withGitIntegrationSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the git_integration_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGitIntegrationSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.\n', args=[]),
+  withGitIntegrationSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          git_integration_settings: value,
+        },
+      },
+    },
+  },
+  '#withGitIntegrationSettingsMixin':: d.fn(help='`google.list[obj].withGitIntegrationSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the git_integration_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGitIntegrationSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.\n', args=[]),
+  withGitIntegrationSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          git_integration_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
@@ -209,6 +323,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withTextToSpeechSettings':: d.fn(help='`google.list[obj].withTextToSpeechSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the text_to_speech_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withTextToSpeechSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.\n', args=[]),
+  withTextToSpeechSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          text_to_speech_settings: value,
+        },
+      },
+    },
+  },
+  '#withTextToSpeechSettingsMixin':: d.fn(help='`google.list[obj].withTextToSpeechSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the text_to_speech_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withTextToSpeechSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.\n', args=[]),
+  withTextToSpeechSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          text_to_speech_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeZone':: d.fn(help='`google.string.withTimeZone` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the time_zone field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `time_zone` field.\n', args=[]),
   withTimeZone(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dialogflow_cx_flow.libsonnet b/4.x/_gen/resources/dialogflow_cx_flow.libsonnet
index e5ea92ec..8da9578a 100644
--- a/4.x/_gen/resources/dialogflow_cx_flow.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_flow.libsonnet
@@ -2,6 +2,36 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_flow', url='', help='`dialogflow_cx_flow` represents the `google_dialogflow_cx_flow` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  advanced_settings:: {
+    audio_export_gcs_destination:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.\nFormat: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `audio_export_gcs_destination` sub block.\n', args=[]),
+      new(
+        uri=null
+      ):: std.prune(a={
+        uri: uri,
+      }),
+    },
+    dtmf_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+      new(
+        enabled=null,
+        finish_digit=null,
+        max_digits=null
+      ):: std.prune(a={
+        enabled: enabled,
+        finish_digit: finish_digit,
+        max_digits: max_digits,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_flow.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:\n* Agent level\n* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+    new(
+      audio_export_gcs_destination=null,
+      dtmf_settings=null
+    ):: std.prune(a={
+      audio_export_gcs_destination: audio_export_gcs_destination,
+      dtmf_settings: dtmf_settings,
+    }),
+  },
   event_handlers:: {
     '#new':: d.fn(help='\n`google.dialogflow_cx_flow.event_handlers.new` constructs a new object with attributes and blocks configured for the `event_handlers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `event` (`string`): The name of the event to handle. When `null`, the `event` field will be omitted from the resulting object.\n  - `target_flow` (`string`): The target flow to transition to.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>. When `null`, the `target_flow` field will be omitted from the resulting object.\n  - `target_page` (`string`): The target page to transition to.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/pages/<Page ID>. When `null`, the `target_page` field will be omitted from the resulting object.\n  - `trigger_fulfillment` (`list[obj]`): The fulfillment to call when the event occurs. Handling webhook errors with a fulfillment enabled with webhook could cause infinite loop. It is invalid to specify such fulfillment for a handler handling webhooks. When `null`, the `trigger_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.trigger_fulfillment.new](#fn-event_handlerstrigger_fulfillmentnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `event_handlers` sub block.\n', args=[]),
     new(
@@ -124,12 +154,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.dialogflow_cx_flow.new` injects a new `google_dialogflow_cx_flow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_flow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_flow` using the reference:\n\n    $._ref.google_dialogflow_cx_flow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_flow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow\u0026#39;s transition route group serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `event_handlers` (`list[obj]`): A flow\u0026#39;s event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page\u0026#39;s [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow\u0026#39;s transition routes serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition routes][Page.transition_routes] and can support use cases such as the user saying \u0026#34;help\u0026#34; or \u0026#34;can I talk to a human?\u0026#34;, which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dialogflow_cx_flow.new` injects a new `google_dialogflow_cx_flow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_flow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_flow` using the reference:\n\n    $._ref.google_dialogflow_cx_flow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_flow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `is_default_start_flow` (`bool`): Marks this as the [Default Start Flow](https://cloud.google.com/dialogflow/cx/docs/concept/flow#start) for an agent. When you create an agent, the Default Start Flow is created automatically.\nThe Default Start Flow cannot be deleted; deleting the \u0026#39;google_dialogflow_cx_flow\u0026#39; resource does nothing to the underlying GCP resources.\n\n~\u0026gt; Avoid having multiple \u0026#39;google_dialogflow_cx_flow\u0026#39; resources linked to the same agent with \u0026#39;is_default_start_flow = true\u0026#39; because they will compete to control a single Default Start Flow resource in GCP. When `null`, the `is_default_start_flow` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow\u0026#39;s transition route group serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent-\u0026gt;Flow-\u0026gt;Page-\u0026gt;Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `event_handlers` (`list[obj]`): A flow\u0026#39;s event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page\u0026#39;s [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow\u0026#39;s transition routes serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition routes][Page.transition_routes] and can support use cases such as the user saying \u0026#34;help\u0026#34; or \u0026#34;can I talk to a human?\u0026#34;, which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
+    advanced_settings=null,
     description=null,
     event_handlers=null,
+    is_default_start_flow=null,
     language_code=null,
     nlu_settings=null,
     parent=null,
@@ -141,9 +173,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_dialogflow_cx_flow',
     label=resourceLabel,
     attrs=self.newAttrs(
+      advanced_settings=advanced_settings,
       description=description,
       display_name=display_name,
       event_handlers=event_handlers,
+      is_default_start_flow=is_default_start_flow,
       language_code=language_code,
       nlu_settings=nlu_settings,
       parent=parent,
@@ -153,11 +187,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_flow.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_flow`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_flow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow's transition route group serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow's transition routes serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition routes][Page.transition_routes] and can support use cases such as the user saying "help" or "can I talk to a human?", which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_flow` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_flow.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_flow`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_flow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `is_default_start_flow` (`bool`): Marks this as the [Default Start Flow](https://cloud.google.com/dialogflow/cx/docs/concept/flow#start) for an agent. When you create an agent, the Default Start Flow is created automatically.\nThe Default Start Flow cannot be deleted; deleting the 'google_dialogflow_cx_flow' resource does nothing to the underlying GCP resources.\n\n~> Avoid having multiple 'google_dialogflow_cx_flow' resources linked to the same agent with 'is_default_start_flow = true' because they will compete to control a single Default Start Flow resource in GCP. When `null`, the `is_default_start_flow` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow's transition route group serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow's transition routes serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition routes][Page.transition_routes] and can support use cases such as the user saying "help" or "can I talk to a human?", which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_flow` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
+    advanced_settings=null,
     description=null,
     event_handlers=null,
+    is_default_start_flow=null,
     language_code=null,
     nlu_settings=null,
     parent=null,
@@ -165,9 +201,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     transition_route_groups=null,
     transition_routes=null
   ):: std.prune(a={
+    advanced_settings: advanced_settings,
     description: description,
     display_name: display_name,
     event_handlers: event_handlers,
+    is_default_start_flow: is_default_start_flow,
     language_code: language_code,
     nlu_settings: nlu_settings,
     parent: parent,
@@ -323,6 +361,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withAdvancedSettings':: d.fn(help='`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_flow+: {
+        [resourceLabel]+: {
+          advanced_settings: value,
+        },
+      },
+    },
+  },
+  '#withAdvancedSettingsMixin':: d.fn(help='`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_flow+: {
+        [resourceLabel]+: {
+          advanced_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
@@ -363,6 +421,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIsDefaultStartFlow':: d.fn(help='`google.bool.withIsDefaultStartFlow` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the is_default_start_flow field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `is_default_start_flow` field.\n', args=[]),
+  withIsDefaultStartFlow(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_flow+: {
+        [resourceLabel]+: {
+          is_default_start_flow: value,
+        },
+      },
+    },
+  },
   '#withLanguageCode':: d.fn(help='`google.string.withLanguageCode` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the language_code field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `language_code` field.\n', args=[]),
   withLanguageCode(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dialogflow_cx_intent.libsonnet b/4.x/_gen/resources/dialogflow_cx_intent.libsonnet
index d98b4465..337460ce 100644
--- a/4.x/_gen/resources/dialogflow_cx_intent.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_intent.libsonnet
@@ -2,11 +2,13 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_intent', url='', help='`dialogflow_cx_intent` represents the `google_dialogflow_cx_intent` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.dialogflow_cx_intent.new` injects a new `google_dialogflow_cx_intent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_intent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_intent` using the reference:\n\n    $._ref.google_dialogflow_cx_intent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_intent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols \u0026#39;-\u0026#39; and \u0026#39;_\u0026#39;. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix \u0026#34;sys-\u0026#34; is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. \u0026#34;sys-head\u0026#34; means the intent is a head intent. \u0026#34;sys.contextual\u0026#34; means the intent is a contextual intent.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dialogflow_cx_intent.new` injects a new `google_dialogflow_cx_intent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_intent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_intent` using the reference:\n\n    $._ref.google_dialogflow_cx_intent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_intent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_default_negative_intent` (`bool`): Marks this as the [Default Negative Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#negative) for an agent. When you create an agent, a Default Negative Intent is created automatically.\nThe Default Negative Intent cannot be deleted; deleting the \u0026#39;google_dialogflow_cx_intent\u0026#39; resource does nothing to the underlying GCP resources.\n\n~\u0026gt; Avoid having multiple \u0026#39;google_dialogflow_cx_intent\u0026#39; resources linked to the same agent with \u0026#39;is_default_negative_intent = true\u0026#39; because they will compete to control a single Default Negative Intent resource in GCP. When `null`, the `is_default_negative_intent` field will be omitted from the resulting object.\n  - `is_default_welcome_intent` (`bool`): Marks this as the [Default Welcome Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#welcome) for an agent. When you create an agent, a Default Welcome Intent is created automatically.\nThe Default Welcome Intent cannot be deleted; deleting the \u0026#39;google_dialogflow_cx_intent\u0026#39; resource does nothing to the underlying GCP resources.\n\n~\u0026gt; Avoid having multiple \u0026#39;google_dialogflow_cx_intent\u0026#39; resources linked to the same agent with \u0026#39;is_default_welcome_intent = true\u0026#39; because they will compete to control a single Default Welcome Intent resource in GCP. When `null`, the `is_default_welcome_intent` field will be omitted from the resulting object.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.\nTo manage the fallback intent, set \u0026#39;is_default_negative_intent = true\u0026#39; When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols \u0026#39;-\u0026#39; and \u0026#39;_\u0026#39;. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix \u0026#34;sys-\u0026#34; is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. \u0026#34;sys-head\u0026#34; means the intent is a head intent. \u0026#34;sys.contextual\u0026#34; means the intent is a contextual intent.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
     description=null,
+    is_default_negative_intent=null,
+    is_default_welcome_intent=null,
     is_fallback=null,
     labels=null,
     language_code=null,
@@ -22,6 +24,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     attrs=self.newAttrs(
       description=description,
       display_name=display_name,
+      is_default_negative_intent=is_default_negative_intent,
+      is_default_welcome_intent=is_default_welcome_intent,
       is_fallback=is_fallback,
       labels=labels,
       language_code=language_code,
@@ -33,10 +37,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_intent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_intent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_intent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_intent` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_intent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_intent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_intent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_default_negative_intent` (`bool`): Marks this as the [Default Negative Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#negative) for an agent. When you create an agent, a Default Negative Intent is created automatically.\nThe Default Negative Intent cannot be deleted; deleting the 'google_dialogflow_cx_intent' resource does nothing to the underlying GCP resources.\n\n~> Avoid having multiple 'google_dialogflow_cx_intent' resources linked to the same agent with 'is_default_negative_intent = true' because they will compete to control a single Default Negative Intent resource in GCP. When `null`, the `is_default_negative_intent` field will be omitted from the resulting object.\n  - `is_default_welcome_intent` (`bool`): Marks this as the [Default Welcome Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#welcome) for an agent. When you create an agent, a Default Welcome Intent is created automatically.\nThe Default Welcome Intent cannot be deleted; deleting the 'google_dialogflow_cx_intent' resource does nothing to the underlying GCP resources.\n\n~> Avoid having multiple 'google_dialogflow_cx_intent' resources linked to the same agent with 'is_default_welcome_intent = true' because they will compete to control a single Default Welcome Intent resource in GCP. When `null`, the `is_default_welcome_intent` field will be omitted from the resulting object.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.\nTo manage the fallback intent, set 'is_default_negative_intent = true' When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_intent` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
+    is_default_negative_intent=null,
+    is_default_welcome_intent=null,
     is_fallback=null,
     labels=null,
     language_code=null,
@@ -48,6 +54,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   ):: std.prune(a={
     description: description,
     display_name: display_name,
+    is_default_negative_intent: is_default_negative_intent,
+    is_default_welcome_intent: is_default_welcome_intent,
     is_fallback: is_fallback,
     labels: labels,
     language_code: language_code,
@@ -121,6 +129,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIsDefaultNegativeIntent':: d.fn(help='`google.bool.withIsDefaultNegativeIntent` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the is_default_negative_intent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `is_default_negative_intent` field.\n', args=[]),
+  withIsDefaultNegativeIntent(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_intent+: {
+        [resourceLabel]+: {
+          is_default_negative_intent: value,
+        },
+      },
+    },
+  },
+  '#withIsDefaultWelcomeIntent':: d.fn(help='`google.bool.withIsDefaultWelcomeIntent` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the is_default_welcome_intent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `is_default_welcome_intent` field.\n', args=[]),
+  withIsDefaultWelcomeIntent(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_intent+: {
+        [resourceLabel]+: {
+          is_default_welcome_intent: value,
+        },
+      },
+    },
+  },
   '#withIsFallback':: d.fn(help='`google.bool.withIsFallback` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the is_fallback field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `is_fallback` field.\n', args=[]),
   withIsFallback(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dialogflow_cx_page.libsonnet b/4.x/_gen/resources/dialogflow_cx_page.libsonnet
index d4cb174c..3bd30e7e 100644
--- a/4.x/_gen/resources/dialogflow_cx_page.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_page.libsonnet
@@ -2,6 +2,26 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_page', url='', help='`dialogflow_cx_page` represents the `google_dialogflow_cx_page` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  advanced_settings:: {
+    dtmf_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_page.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+      new(
+        enabled=null,
+        finish_digit=null,
+        max_digits=null
+      ):: std.prune(a={
+        enabled: enabled,
+        finish_digit: finish_digit,
+        max_digits: max_digits,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_page.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+    new(
+      dtmf_settings=null
+    ):: std.prune(a={
+      dtmf_settings: dtmf_settings,
+    }),
+  },
   entry_fulfillment:: {
     conditional_cases:: {
       '#new':: d.fn(help='\n`google.dialogflow_cx_page.entry_fulfillment.conditional_cases.new` constructs a new object with attributes and blocks configured for the `conditional_cases`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cases` (`string`): A JSON encoded list of cascading if-else conditions. Cases are mutually exclusive. The first one with a matching condition is selected, all the rest ignored.\nSee [Case](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/Fulfillment#case) for the schema. When `null`, the `cases` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `conditional_cases` sub block.\n', args=[]),
@@ -240,6 +260,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       parameters: parameters,
     }),
     parameters:: {
+      advanced_settings:: {
+        dtmf_settings:: {
+          '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+          new(
+            enabled=null,
+            finish_digit=null,
+            max_digits=null
+          ):: std.prune(a={
+            enabled: enabled,
+            finish_digit: finish_digit,
+            max_digits: max_digits,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new](#fn-formformparametersdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+        new(
+          dtmf_settings=null
+        ):: std.prune(a={
+          dtmf_settings: dtmf_settings,
+        }),
+      },
       fill_behavior:: {
         initial_prompt_fulfillment:: {
           conditional_cases:: {
@@ -480,8 +520,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           },
         },
       },
-      '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.new` constructs a new object with attributes and blocks configured for the `parameters`\nTerraform sub block.\n\n\n\n**Args**:\n  - `default_value` (`string`): The default value of an optional parameter. If the parameter is required, the default value will be ignored. When `null`, the `default_value` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the parameter, unique within the form. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `entity_type` (`string`): The entity type of the parameter.\nFormat: projects/-/locations/-/agents/-/entityTypes/<System Entity Type ID> for system entity types (for example, projects/-/locations/-/agents/-/entityTypes/sys.date), or projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/entityTypes/<Entity Type ID> for developer entity types. When `null`, the `entity_type` field will be omitted from the resulting object.\n  - `is_list` (`bool`): Indicates whether the parameter represents a list of values. When `null`, the `is_list` field will be omitted from the resulting object.\n  - `redact` (`bool`): Indicates whether the parameter content should be redacted in log.\nIf redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled. When `null`, the `redact` field will be omitted from the resulting object.\n  - `required` (`bool`): Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them.\nRequired parameters must be filled before form filling concludes. When `null`, the `required` field will be omitted from the resulting object.\n  - `fill_behavior` (`list[obj]`): Defines fill behavior for the parameter. When `null`, the `fill_behavior` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.fill_behavior.new](#fn-formformfill_behaviornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `parameters` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.new` constructs a new object with attributes and blocks configured for the `parameters`\nTerraform sub block.\n\n\n\n**Args**:\n  - `default_value` (`string`): The default value of an optional parameter. If the parameter is required, the default value will be ignored. When `null`, the `default_value` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the parameter, unique within the form. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `entity_type` (`string`): The entity type of the parameter.\nFormat: projects/-/locations/-/agents/-/entityTypes/<System Entity Type ID> for system entity types (for example, projects/-/locations/-/agents/-/entityTypes/sys.date), or projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/entityTypes/<Entity Type ID> for developer entity types. When `null`, the `entity_type` field will be omitted from the resulting object.\n  - `is_list` (`bool`): Indicates whether the parameter represents a list of values. When `null`, the `is_list` field will be omitted from the resulting object.\n  - `redact` (`bool`): Indicates whether the parameter content should be redacted in log.\nIf redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled. When `null`, the `redact` field will be omitted from the resulting object.\n  - `required` (`bool`): Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them.\nRequired parameters must be filled before form filling concludes. When `null`, the `required` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this parameter. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.new](#fn-formformadvanced_settingsnew) constructor.\n  - `fill_behavior` (`list[obj]`): Defines fill behavior for the parameter. When `null`, the `fill_behavior` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.fill_behavior.new](#fn-formformfill_behaviornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `parameters` sub block.\n', args=[]),
       new(
+        advanced_settings=null,
         default_value=null,
         display_name=null,
         entity_type=null,
@@ -490,6 +531,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         redact=null,
         required=null
       ):: std.prune(a={
+        advanced_settings: advanced_settings,
         default_value: default_value,
         display_name: display_name,
         entity_type: entity_type,
@@ -500,10 +542,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.dialogflow_cx_page.new` injects a new `google_dialogflow_cx_page` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_page.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_page` using the reference:\n\n    $._ref.google_dialogflow_cx_page.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_page.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page\u0026#39;s transition route -\u0026gt; page\u0026#39;s transition route group -\u0026gt; flow\u0026#39;s transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dialogflow_cx_page.new` injects a new `google_dialogflow_cx_page` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_page.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_page` using the reference:\n\n    $._ref.google_dialogflow_cx_page.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_page.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page\u0026#39;s transition route -\u0026gt; page\u0026#39;s transition route group -\u0026gt; flow\u0026#39;s transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent-\u0026gt;Flow-\u0026gt;Page-\u0026gt;Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
+    advanced_settings=null,
     entry_fulfillment=null,
     event_handlers=null,
     form=null,
@@ -517,6 +560,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_dialogflow_cx_page',
     label=resourceLabel,
     attrs=self.newAttrs(
+      advanced_settings=advanced_settings,
       display_name=display_name,
       entry_fulfillment=entry_fulfillment,
       event_handlers=event_handlers,
@@ -529,9 +573,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_page.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_page`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_page.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_page` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_page.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_page`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_page.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_page` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
+    advanced_settings=null,
     entry_fulfillment=null,
     event_handlers=null,
     form=null,
@@ -541,6 +586,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     transition_route_groups=null,
     transition_routes=null
   ):: std.prune(a={
+    advanced_settings: advanced_settings,
     display_name: display_name,
     entry_fulfillment: entry_fulfillment,
     event_handlers: event_handlers,
@@ -687,6 +733,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withAdvancedSettings':: d.fn(help='`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_page+: {
+        [resourceLabel]+: {
+          advanced_settings: value,
+        },
+      },
+    },
+  },
+  '#withAdvancedSettingsMixin':: d.fn(help='`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_page+: {
+        [resourceLabel]+: {
+          advanced_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
   withDisplayName(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/discovery_engine_chat_engine.libsonnet b/4.x/_gen/resources/discovery_engine_chat_engine.libsonnet
new file mode 100644
index 00000000..b33adf47
--- /dev/null
+++ b/4.x/_gen/resources/discovery_engine_chat_engine.libsonnet
@@ -0,0 +1,232 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='discovery_engine_chat_engine', url='', help='`discovery_engine_chat_engine` represents the `google_discovery_engine_chat_engine` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  chat_engine_config:: {
+    agent_creation_config:: {
+      '#new':: d.fn(help='\n`google.discovery_engine_chat_engine.chat_engine_config.agent_creation_config.new` constructs a new object with attributes and blocks configured for the `agent_creation_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `business` (`string`): Name of the company, organization or other entity that the agent represents. Used for knowledge connector LLM prompt and for knowledge search. When `null`, the `business` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/docs/reference/language) for a list of the currently supported language codes.\n  - `location` (`string`): Agent location for Agent creation, currently supported values: global/us/eu, it needs to be the same region as the Chat Engine. When `null`, the `location` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of the agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris.\n\n**Returns**:\n  - An attribute object that represents the `agent_creation_config` sub block.\n', args=[]),
+      new(
+        default_language_code,
+        time_zone,
+        business=null,
+        location=null
+      ):: std.prune(a={
+        business: business,
+        default_language_code: default_language_code,
+        location: location,
+        time_zone: time_zone,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.discovery_engine_chat_engine.chat_engine_config.new` constructs a new object with attributes and blocks configured for the `chat_engine_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `agent_creation_config` (`list[obj]`): The configuration to generate the Dialogflow agent that is associated to this Engine. When `null`, the `agent_creation_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.chat_engine_config.agent_creation_config.new](#fn-chat_engine_configagent_creation_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `chat_engine_config` sub block.\n', args=[]),
+    new(
+      agent_creation_config=null
+    ):: std.prune(a={
+      agent_creation_config: agent_creation_config,
+    }),
+  },
+  common_config:: {
+    '#new':: d.fn(help='\n`google.discovery_engine_chat_engine.common_config.new` constructs a new object with attributes and blocks configured for the `common_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `company_name` (`string`): The name of the company, business or entity that is associated with the engine. Setting this may help improve LLM related features. When `null`, the `company_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `common_config` sub block.\n', args=[]),
+    new(
+      company_name=null
+    ):: std.prune(a={
+      company_name: company_name,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.discovery_engine_chat_engine.new` injects a new `google_discovery_engine_chat_engine` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.discovery_engine_chat_engine.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.discovery_engine_chat_engine` using the reference:\n\n    $._ref.google_discovery_engine_chat_engine.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_discovery_engine_chat_engine.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection_id` (`string`): The collection ID.\n  - `data_store_ids` (`list`): The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be \u0026#39;SOLUTION_TYPE_CHAT\u0026#39;. Adding or removing data stores will force recreation.\n  - `display_name` (`string`): The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.\n  - `engine_id` (`string`): The ID to use for chat engine.\n  - `industry_vertical` (`string`): The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked to the engine. Default value: \u0026#34;GENERIC\u0026#34; Possible values: [\u0026#34;GENERIC\u0026#34;] When `null`, the `industry_vertical` field will be omitted from the resulting object.\n  - `location` (`string`): Location.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `chat_engine_config` (`list[obj]`): Configurations for a chat Engine. When `null`, the `chat_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.chat_engine_config.new](#fn-chat_engine_confignew) constructor.\n  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.common_config.new](#fn-common_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    collection_id,
+    data_store_ids,
+    display_name,
+    engine_id,
+    location,
+    chat_engine_config=null,
+    common_config=null,
+    industry_vertical=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_discovery_engine_chat_engine',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      chat_engine_config=chat_engine_config,
+      collection_id=collection_id,
+      common_config=common_config,
+      data_store_ids=data_store_ids,
+      display_name=display_name,
+      engine_id=engine_id,
+      industry_vertical=industry_vertical,
+      location=location,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.discovery_engine_chat_engine.newAttrs` constructs a new object with attributes and blocks configured for the `discovery_engine_chat_engine`\nTerraform resource.\n\nUnlike [google.discovery_engine_chat_engine.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection_id` (`string`): The collection ID.\n  - `data_store_ids` (`list`): The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be 'SOLUTION_TYPE_CHAT'. Adding or removing data stores will force recreation.\n  - `display_name` (`string`): The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.\n  - `engine_id` (`string`): The ID to use for chat engine.\n  - `industry_vertical` (`string`): The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked to the engine. Default value: "GENERIC" Possible values: ["GENERIC"] When `null`, the `industry_vertical` field will be omitted from the resulting object.\n  - `location` (`string`): Location.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `chat_engine_config` (`list[obj]`): Configurations for a chat Engine. When `null`, the `chat_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.chat_engine_config.new](#fn-chat_engine_confignew) constructor.\n  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.common_config.new](#fn-common_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `discovery_engine_chat_engine` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    collection_id,
+    data_store_ids,
+    display_name,
+    engine_id,
+    location,
+    chat_engine_config=null,
+    common_config=null,
+    industry_vertical=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    chat_engine_config: chat_engine_config,
+    collection_id: collection_id,
+    common_config: common_config,
+    data_store_ids: data_store_ids,
+    display_name: display_name,
+    engine_id: engine_id,
+    industry_vertical: industry_vertical,
+    location: location,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.discovery_engine_chat_engine.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withChatEngineConfig':: d.fn(help='`google.list[obj].withChatEngineConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the chat_engine_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withChatEngineConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `chat_engine_config` field.\n', args=[]),
+  withChatEngineConfig(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          chat_engine_config: value,
+        },
+      },
+    },
+  },
+  '#withChatEngineConfigMixin':: d.fn(help='`google.list[obj].withChatEngineConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the chat_engine_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withChatEngineConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `chat_engine_config` field.\n', args=[]),
+  withChatEngineConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          chat_engine_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withCollectionId':: d.fn(help='`google.string.withCollectionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the collection_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `collection_id` field.\n', args=[]),
+  withCollectionId(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          collection_id: value,
+        },
+      },
+    },
+  },
+  '#withCommonConfig':: d.fn(help='`google.list[obj].withCommonConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the common_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCommonConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `common_config` field.\n', args=[]),
+  withCommonConfig(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          common_config: value,
+        },
+      },
+    },
+  },
+  '#withCommonConfigMixin':: d.fn(help='`google.list[obj].withCommonConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the common_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCommonConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `common_config` field.\n', args=[]),
+  withCommonConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          common_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataStoreIds':: d.fn(help='`google.list.withDataStoreIds` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the data_store_ids field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `data_store_ids` field.\n', args=[]),
+  withDataStoreIds(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          data_store_ids: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEngineId':: d.fn(help='`google.string.withEngineId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the engine_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `engine_id` field.\n', args=[]),
+  withEngineId(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          engine_id: value,
+        },
+      },
+    },
+  },
+  '#withIndustryVertical':: d.fn(help='`google.string.withIndustryVertical` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the industry_vertical field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `industry_vertical` field.\n', args=[]),
+  withIndustryVertical(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          industry_vertical: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_chat_engine+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/discovery_engine_data_store.libsonnet b/4.x/_gen/resources/discovery_engine_data_store.libsonnet
new file mode 100644
index 00000000..0f903679
--- /dev/null
+++ b/4.x/_gen/resources/discovery_engine_data_store.libsonnet
@@ -0,0 +1,168 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='discovery_engine_data_store', url='', help='`discovery_engine_data_store` represents the `google_discovery_engine_data_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.discovery_engine_data_store.new` injects a new `google_discovery_engine_data_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.discovery_engine_data_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.discovery_engine_data_store` using the reference:\n\n    $._ref.google_discovery_engine_data_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_discovery_engine_data_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `content_config` (`string`): The content config of the data store. Possible values: [\u0026#34;NO_CONTENT\u0026#34;, \u0026#34;CONTENT_REQUIRED\u0026#34;, \u0026#34;PUBLIC_WEBSITE\u0026#34;]\n  - `create_advanced_site_search` (`bool`): If true, an advanced data store for site search will be created. If the\ndata store is not configured as site search (GENERIC vertical and\nPUBLIC_WEBSITE contentConfig), this flag will be ignored. When `null`, the `create_advanced_site_search` field will be omitted from the resulting object.\n  - `data_store_id` (`string`): The unique id of the data store.\n  - `display_name` (`string`): The display name of the data store. This field must be a UTF-8 encoded\nstring with a length limit of 128 characters.\n  - `industry_vertical` (`string`): The industry vertical that the data store registers. Possible values: [\u0026#34;GENERIC\u0026#34;, \u0026#34;MEDIA\u0026#34;]\n  - `location` (`string`): The geographic location where the data store should reside. The value can\nonly be one of \u0026#34;global\u0026#34;, \u0026#34;us\u0026#34; and \u0026#34;eu\u0026#34;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `solution_types` (`list`): The solutions that the data store enrolls. Possible values: [\u0026#34;SOLUTION_TYPE_RECOMMENDATION\u0026#34;, \u0026#34;SOLUTION_TYPE_SEARCH\u0026#34;, \u0026#34;SOLUTION_TYPE_CHAT\u0026#34;] When `null`, the `solution_types` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_data_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    content_config,
+    data_store_id,
+    display_name,
+    industry_vertical,
+    location,
+    create_advanced_site_search=null,
+    project=null,
+    solution_types=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_discovery_engine_data_store',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      content_config=content_config,
+      create_advanced_site_search=create_advanced_site_search,
+      data_store_id=data_store_id,
+      display_name=display_name,
+      industry_vertical=industry_vertical,
+      location=location,
+      project=project,
+      solution_types=solution_types,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.discovery_engine_data_store.newAttrs` constructs a new object with attributes and blocks configured for the `discovery_engine_data_store`\nTerraform resource.\n\nUnlike [google.discovery_engine_data_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `content_config` (`string`): The content config of the data store. Possible values: ["NO_CONTENT", "CONTENT_REQUIRED", "PUBLIC_WEBSITE"]\n  - `create_advanced_site_search` (`bool`): If true, an advanced data store for site search will be created. If the\ndata store is not configured as site search (GENERIC vertical and\nPUBLIC_WEBSITE contentConfig), this flag will be ignored. When `null`, the `create_advanced_site_search` field will be omitted from the resulting object.\n  - `data_store_id` (`string`): The unique id of the data store.\n  - `display_name` (`string`): The display name of the data store. This field must be a UTF-8 encoded\nstring with a length limit of 128 characters.\n  - `industry_vertical` (`string`): The industry vertical that the data store registers. Possible values: ["GENERIC", "MEDIA"]\n  - `location` (`string`): The geographic location where the data store should reside. The value can\nonly be one of "global", "us" and "eu".\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `solution_types` (`list`): The solutions that the data store enrolls. Possible values: ["SOLUTION_TYPE_RECOMMENDATION", "SOLUTION_TYPE_SEARCH", "SOLUTION_TYPE_CHAT"] When `null`, the `solution_types` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_data_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `discovery_engine_data_store` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    content_config,
+    data_store_id,
+    display_name,
+    industry_vertical,
+    location,
+    create_advanced_site_search=null,
+    project=null,
+    solution_types=null,
+    timeouts=null
+  ):: std.prune(a={
+    content_config: content_config,
+    create_advanced_site_search: create_advanced_site_search,
+    data_store_id: data_store_id,
+    display_name: display_name,
+    industry_vertical: industry_vertical,
+    location: location,
+    project: project,
+    solution_types: solution_types,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.discovery_engine_data_store.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withContentConfig':: d.fn(help='`google.string.withContentConfig` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the content_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `content_config` field.\n', args=[]),
+  withContentConfig(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          content_config: value,
+        },
+      },
+    },
+  },
+  '#withCreateAdvancedSiteSearch':: d.fn(help='`google.bool.withCreateAdvancedSiteSearch` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the create_advanced_site_search field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `create_advanced_site_search` field.\n', args=[]),
+  withCreateAdvancedSiteSearch(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          create_advanced_site_search: value,
+        },
+      },
+    },
+  },
+  '#withDataStoreId':: d.fn(help='`google.string.withDataStoreId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the data_store_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `data_store_id` field.\n', args=[]),
+  withDataStoreId(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          data_store_id: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withIndustryVertical':: d.fn(help='`google.string.withIndustryVertical` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the industry_vertical field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `industry_vertical` field.\n', args=[]),
+  withIndustryVertical(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          industry_vertical: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSolutionTypes':: d.fn(help='`google.list.withSolutionTypes` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the solution_types field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `solution_types` field.\n', args=[]),
+  withSolutionTypes(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          solution_types: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_data_store+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/discovery_engine_search_engine.libsonnet b/4.x/_gen/resources/discovery_engine_search_engine.libsonnet
new file mode 100644
index 00000000..a792e6da
--- /dev/null
+++ b/4.x/_gen/resources/discovery_engine_search_engine.libsonnet
@@ -0,0 +1,220 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='discovery_engine_search_engine', url='', help='`discovery_engine_search_engine` represents the `google_discovery_engine_search_engine` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  common_config:: {
+    '#new':: d.fn(help='\n`google.discovery_engine_search_engine.common_config.new` constructs a new object with attributes and blocks configured for the `common_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `company_name` (`string`): The name of the company, business or entity that is associated with the engine. Setting this may help improve LLM related features.cd When `null`, the `company_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `common_config` sub block.\n', args=[]),
+    new(
+      company_name=null
+    ):: std.prune(a={
+      company_name: company_name,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.discovery_engine_search_engine.new` injects a new `google_discovery_engine_search_engine` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.discovery_engine_search_engine.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.discovery_engine_search_engine` using the reference:\n\n    $._ref.google_discovery_engine_search_engine.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_discovery_engine_search_engine.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection_id` (`string`): The collection ID.\n  - `data_store_ids` (`list`): The data stores associated with this engine. For SOLUTION_TYPE_SEARCH type of engines, they can only associate with at most one data store.\n  - `display_name` (`string`): Required. The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.\n  - `engine_id` (`string`): Unique ID to use for Search Engine App.\n  - `industry_vertical` (`string`): The industry vertical that the engine registers. The restriction of the Engine industry vertical is based on DataStore: If unspecified, default to GENERIC. Vertical on Engine has to match vertical of the DataStore liniked to the engine. Default value: \u0026#34;GENERIC\u0026#34; Possible values: [\u0026#34;GENERIC\u0026#34;, \u0026#34;MEDIA\u0026#34;] When `null`, the `industry_vertical` field will be omitted from the resulting object.\n  - `location` (`string`): Location.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.common_config.new](#fn-common_confignew) constructor.\n  - `search_engine_config` (`list[obj]`): Configurations for a Search Engine. When `null`, the `search_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.search_engine_config.new](#fn-search_engine_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    collection_id,
+    data_store_ids,
+    display_name,
+    engine_id,
+    location,
+    common_config=null,
+    industry_vertical=null,
+    project=null,
+    search_engine_config=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_discovery_engine_search_engine',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      collection_id=collection_id,
+      common_config=common_config,
+      data_store_ids=data_store_ids,
+      display_name=display_name,
+      engine_id=engine_id,
+      industry_vertical=industry_vertical,
+      location=location,
+      project=project,
+      search_engine_config=search_engine_config,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.discovery_engine_search_engine.newAttrs` constructs a new object with attributes and blocks configured for the `discovery_engine_search_engine`\nTerraform resource.\n\nUnlike [google.discovery_engine_search_engine.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection_id` (`string`): The collection ID.\n  - `data_store_ids` (`list`): The data stores associated with this engine. For SOLUTION_TYPE_SEARCH type of engines, they can only associate with at most one data store.\n  - `display_name` (`string`): Required. The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.\n  - `engine_id` (`string`): Unique ID to use for Search Engine App.\n  - `industry_vertical` (`string`): The industry vertical that the engine registers. The restriction of the Engine industry vertical is based on DataStore: If unspecified, default to GENERIC. Vertical on Engine has to match vertical of the DataStore liniked to the engine. Default value: "GENERIC" Possible values: ["GENERIC", "MEDIA"] When `null`, the `industry_vertical` field will be omitted from the resulting object.\n  - `location` (`string`): Location.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.common_config.new](#fn-common_confignew) constructor.\n  - `search_engine_config` (`list[obj]`): Configurations for a Search Engine. When `null`, the `search_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.search_engine_config.new](#fn-search_engine_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `discovery_engine_search_engine` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    collection_id,
+    data_store_ids,
+    display_name,
+    engine_id,
+    location,
+    common_config=null,
+    industry_vertical=null,
+    project=null,
+    search_engine_config=null,
+    timeouts=null
+  ):: std.prune(a={
+    collection_id: collection_id,
+    common_config: common_config,
+    data_store_ids: data_store_ids,
+    display_name: display_name,
+    engine_id: engine_id,
+    industry_vertical: industry_vertical,
+    location: location,
+    project: project,
+    search_engine_config: search_engine_config,
+    timeouts: timeouts,
+  }),
+  search_engine_config:: {
+    '#new':: d.fn(help='\n`google.discovery_engine_search_engine.search_engine_config.new` constructs a new object with attributes and blocks configured for the `search_engine_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `search_add_ons` (`list`): The add-on that this search engine enables. Possible values: ["SEARCH_ADD_ON_LLM"] When `null`, the `search_add_ons` field will be omitted from the resulting object.\n  - `search_tier` (`string`): The search feature tier of this engine. Defaults to SearchTier.SEARCH_TIER_STANDARD if not specified. Default value: "SEARCH_TIER_STANDARD" Possible values: ["SEARCH_TIER_STANDARD", "SEARCH_TIER_ENTERPRISE"] When `null`, the `search_tier` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `search_engine_config` sub block.\n', args=[]),
+    new(
+      search_add_ons=null,
+      search_tier=null
+    ):: std.prune(a={
+      search_add_ons: search_add_ons,
+      search_tier: search_tier,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.discovery_engine_search_engine.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCollectionId':: d.fn(help='`google.string.withCollectionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the collection_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `collection_id` field.\n', args=[]),
+  withCollectionId(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          collection_id: value,
+        },
+      },
+    },
+  },
+  '#withCommonConfig':: d.fn(help='`google.list[obj].withCommonConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the common_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCommonConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `common_config` field.\n', args=[]),
+  withCommonConfig(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          common_config: value,
+        },
+      },
+    },
+  },
+  '#withCommonConfigMixin':: d.fn(help='`google.list[obj].withCommonConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the common_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCommonConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `common_config` field.\n', args=[]),
+  withCommonConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          common_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataStoreIds':: d.fn(help='`google.list.withDataStoreIds` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the data_store_ids field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `data_store_ids` field.\n', args=[]),
+  withDataStoreIds(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          data_store_ids: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEngineId':: d.fn(help='`google.string.withEngineId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the engine_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `engine_id` field.\n', args=[]),
+  withEngineId(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          engine_id: value,
+        },
+      },
+    },
+  },
+  '#withIndustryVertical':: d.fn(help='`google.string.withIndustryVertical` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the industry_vertical field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `industry_vertical` field.\n', args=[]),
+  withIndustryVertical(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          industry_vertical: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSearchEngineConfig':: d.fn(help='`google.list[obj].withSearchEngineConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the search_engine_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSearchEngineConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `search_engine_config` field.\n', args=[]),
+  withSearchEngineConfig(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          search_engine_config: value,
+        },
+      },
+    },
+  },
+  '#withSearchEngineConfigMixin':: d.fn(help='`google.list[obj].withSearchEngineConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the search_engine_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSearchEngineConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `search_engine_config` field.\n', args=[]),
+  withSearchEngineConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          search_engine_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_discovery_engine_search_engine+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/dns_managed_zone.libsonnet b/4.x/_gen/resources/dns_managed_zone.libsonnet
index 8c71e953..dde8b293 100644
--- a/4.x/_gen/resources/dns_managed_zone.libsonnet
+++ b/4.x/_gen/resources/dns_managed_zone.libsonnet
@@ -56,7 +56,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.dns_managed_zone.new` injects a new `google_dns_managed_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dns_managed_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dns_managed_zone` using the reference:\n\n    $._ref.google_dns_managed_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dns_managed_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A textual description field. Defaults to \u0026#39;Managed by Terraform\u0026#39;. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance \u0026#34;example.com.\u0026#34;.\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone\u0026#39;s visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: \u0026#34;public\u0026#34; Possible values: [\u0026#34;private\u0026#34;, \u0026#34;public\u0026#34;] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of \u0026#39;gke_clusters\u0026#39; or \u0026#39;networks\u0026#39; must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dns_managed_zone.new` injects a new `google_dns_managed_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dns_managed_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dns_managed_zone` using the reference:\n\n    $._ref.google_dns_managed_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dns_managed_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A textual description field. Defaults to \u0026#39;Managed by Terraform\u0026#39;. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance \u0026#34;example.com.\u0026#34;.\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone\u0026#39;s visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: \u0026#34;public\u0026#34; Possible values: [\u0026#34;private\u0026#34;, \u0026#34;public\u0026#34;] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of \u0026#39;gke_clusters\u0026#39; or \u0026#39;networks\u0026#39; must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dns_name,
@@ -93,7 +93,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dns_managed_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dns_managed_zone`\nTerraform resource.\n\nUnlike [google.dns_managed_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone's visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: "public" Possible values: ["private", "public"] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of 'gke_clusters' or 'networks' must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dns_managed_zone` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dns_managed_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dns_managed_zone`\nTerraform resource.\n\nUnlike [google.dns_managed_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone's visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: "public" Possible values: ["private", "public"] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of 'gke_clusters' or 'networks' must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dns_managed_zone` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dns_name,
     name,
diff --git a/4.x/_gen/resources/edgecontainer_cluster.libsonnet b/4.x/_gen/resources/edgecontainer_cluster.libsonnet
new file mode 100644
index 00000000..f80362cb
--- /dev/null
+++ b/4.x/_gen/resources/edgecontainer_cluster.libsonnet
@@ -0,0 +1,468 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='edgecontainer_cluster', url='', help='`edgecontainer_cluster` represents the `google_edgecontainer_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  authorization:: {
+    admin_users:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): An active Google username.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+      new(
+        username
+      ):: std.prune(a={
+        username: username,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): User that will be granted the cluster-admin role on the cluster, providing\nfull access to the cluster. Currently, this is a singular field, but will\nbe expanded to allow multiple admins in the future. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    new(
+      admin_users=null
+    ):: std.prune(a={
+      admin_users: admin_users,
+    }),
+  },
+  control_plane:: {
+    'local':: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane.local.new` constructs a new object with attributes and blocks configured for the `local`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_filter` (`string`): Only machines matching this filter will be allowed to host control\nplane nodes. The filtering language accepts strings like "name=<name>",\nand is documented here: [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.\n  - `node_count` (`number`): The number of nodes to serve as replicas of the Control Plane.\nOnly 1 and 3 are supported. When `null`, the `node_count` field will be omitted from the resulting object.\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool\nwill be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.\n  - `shared_deployment_policy` (`string`): Policy configuration about how user applications are deployed. Possible values: ["SHARED_DEPLOYMENT_POLICY_UNSPECIFIED", "ALLOWED", "DISALLOWED"] When `null`, the `shared_deployment_policy` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `local` sub block.\n', args=[]),
+      new(
+        machine_filter=null,
+        node_count=null,
+        node_location=null,
+        shared_deployment_policy=null
+      ):: std.prune(a={
+        machine_filter: machine_filter,
+        node_count: node_count,
+        node_location: node_location,
+        shared_deployment_policy: shared_deployment_policy,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`\nTerraform sub block.\n\n\n\n**Args**:\n  - `local_` (`list[obj]`): Local control plane configuration. When `null`, the `local_` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.local_.new](#fn-control_planelocal_new) constructor.\n  - `remote` (`list[obj]`): Remote control plane configuration. When `null`, the `remote` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.remote.new](#fn-control_planeremotenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane` sub block.\n', args=[]),
+    new(
+      local_=null,
+      remote=null
+    ):: std.prune(a={
+      'local': local_,
+      remote: remote,
+    }),
+    remote:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane.remote.new` constructs a new object with attributes and blocks configured for the `remote`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool\nwill be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `remote` sub block.\n', args=[]),
+      new(
+        node_location=null
+      ):: std.prune(a={
+        node_location: node_location,
+      }),
+    },
+  },
+  control_plane_encryption:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane_encryption.new` constructs a new object with attributes and blocks configured for the `control_plane_encryption`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g.\nprojects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}\nto use for protecting control plane disks. If not specified, a\nGoogle-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_encryption` sub block.\n', args=[]),
+    new(
+      kms_key=null
+    ):: std.prune(a={
+      kms_key: kms_key,
+    }),
+  },
+  fleet:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.fleet.new` constructs a new object with attributes and blocks configured for the `fleet`\nTerraform sub block.\n\n\n\n**Args**:\n  - `project` (`string`): The name of the Fleet host project where this cluster will be registered.\nProject names are formatted as\n'projects/<project-number>'.\n\n**Returns**:\n  - An attribute object that represents the `fleet` sub block.\n', args=[]),
+    new(
+      project
+    ):: std.prune(a={
+      project: project,
+    }),
+  },
+  maintenance_policy:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.new` constructs a new object with attributes and blocks configured for the `maintenance_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `window` (`list[obj]`): Specifies the maintenance window in which maintenance may be performed. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.new](#fn-maintenance_policywindownew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `maintenance_policy` sub block.\n', args=[]),
+    new(
+      window=null
+    ):: std.prune(a={
+      window: window,
+    }),
+    window:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.window.new` constructs a new object with attributes and blocks configured for the `window`\nTerraform sub block.\n\n\n\n**Args**:\n  - `recurring_window` (`list[obj]`): Represents an arbitrary window of time that recurs. When `null`, the `recurring_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new](#fn-maintenance_policymaintenance_policyrecurring_windownew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `window` sub block.\n', args=[]),
+      new(
+        recurring_window=null
+      ):: std.prune(a={
+        recurring_window: recurring_window,
+      }),
+      recurring_window:: {
+        '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new` constructs a new object with attributes and blocks configured for the `recurring_window`\nTerraform sub block.\n\n\n\n**Args**:\n  - `recurrence` (`string`): An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how\nthis window recurs. They go on for the span of time between the start and\nend time. When `null`, the `recurrence` field will be omitted from the resulting object.\n  - `window` (`list[obj]`): Represents an arbitrary window of time. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new](#fn-maintenance_policymaintenance_policywindowwindownew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `recurring_window` sub block.\n', args=[]),
+        new(
+          recurrence=null,
+          window=null
+        ):: std.prune(a={
+          recurrence: recurrence,
+          window: window,
+        }),
+        window:: {
+          '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new` constructs a new object with attributes and blocks configured for the `window`\nTerraform sub block.\n\n\n\n**Args**:\n  - `end_time` (`string`): The time that the window ends. The end time must take place after the\nstart time. When `null`, the `end_time` field will be omitted from the resulting object.\n  - `start_time` (`string`): The time that the window first starts. When `null`, the `start_time` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `window` sub block.\n', args=[]),
+          new(
+            end_time=null,
+            start_time=null
+          ):: std.prune(a={
+            end_time: end_time,
+            start_time: start_time,
+          }),
+        },
+      },
+    },
+  },
+  networking:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.networking.new` constructs a new object with attributes and blocks configured for the `networking`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cluster_ipv4_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these\nblocks. Only a single block is supported. This field cannot be changed\nafter creation.\n  - `cluster_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all pods in the cluster are\nassigned an IPv6 address from these blocks alongside from an IPv4\naddress. Only a single block is supported. This field cannot be changed\nafter creation. When `null`, the `cluster_ipv6_cidr_blocks` field will be omitted from the resulting object.\n  - `services_ipv4_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these\nblocks. Only a single block is supported. This field cannot be changed\nafter creation.\n  - `services_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all services in the cluster are\nassigned an IPv6 address from these blocks alongside from an IPv4\naddress. Only a single block is supported. This field cannot be changed\nafter creation. When `null`, the `services_ipv6_cidr_blocks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `networking` sub block.\n', args=[]),
+    new(
+      cluster_ipv4_cidr_blocks,
+      services_ipv4_cidr_blocks,
+      cluster_ipv6_cidr_blocks=null,
+      services_ipv6_cidr_blocks=null
+    ):: std.prune(a={
+      cluster_ipv4_cidr_blocks: cluster_ipv4_cidr_blocks,
+      cluster_ipv6_cidr_blocks: cluster_ipv6_cidr_blocks,
+      services_ipv4_cidr_blocks: services_ipv4_cidr_blocks,
+      services_ipv6_cidr_blocks: services_ipv6_cidr_blocks,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.edgecontainer_cluster.new` injects a new `google_edgecontainer_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.edgecontainer_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.edgecontainer_cluster` using the reference:\n\n    $._ref.google_edgecontainer_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_edgecontainer_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not\nspecified explicitly for a node pool in this cluster. If unspecified, the\nKubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the edgecloud cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The GDCE cluster name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: [\u0026#34;RELEASE_CHANNEL_UNSPECIFIED\u0026#34;, \u0026#34;NONE\u0026#34;, \u0026#34;REGULAR\u0026#34;] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `target_version` (`string`): The target cluster version. For example: \u0026#34;1.5.0\u0026#34;. When `null`, the `target_version` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when\nenabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.\n  - `fleet` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `networking` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.\n  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    authorization=null,
+    control_plane=null,
+    control_plane_encryption=null,
+    default_max_pods_per_node=null,
+    external_load_balancer_ipv4_address_pools=null,
+    fleet=null,
+    labels=null,
+    maintenance_policy=null,
+    networking=null,
+    project=null,
+    release_channel=null,
+    system_addons_config=null,
+    target_version=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_edgecontainer_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      authorization=authorization,
+      control_plane=control_plane,
+      control_plane_encryption=control_plane_encryption,
+      default_max_pods_per_node=default_max_pods_per_node,
+      external_load_balancer_ipv4_address_pools=external_load_balancer_ipv4_address_pools,
+      fleet=fleet,
+      labels=labels,
+      location=location,
+      maintenance_policy=maintenance_policy,
+      name=name,
+      networking=networking,
+      project=project,
+      release_channel=release_channel,
+      system_addons_config=system_addons_config,
+      target_version=target_version,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.edgecontainer_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_cluster`\nTerraform resource.\n\nUnlike [google.edgecontainer_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not\nspecified explicitly for a node pool in this cluster. If unspecified, the\nKubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the edgecloud cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The GDCE cluster name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: ["RELEASE_CHANNEL_UNSPECIFIED", "NONE", "REGULAR"] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `target_version` (`string`): The target cluster version. For example: "1.5.0". When `null`, the `target_version` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when\nenabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.\n  - `fleet` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `networking` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.\n  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    authorization=null,
+    control_plane=null,
+    control_plane_encryption=null,
+    default_max_pods_per_node=null,
+    external_load_balancer_ipv4_address_pools=null,
+    fleet=null,
+    labels=null,
+    maintenance_policy=null,
+    networking=null,
+    project=null,
+    release_channel=null,
+    system_addons_config=null,
+    target_version=null,
+    timeouts=null
+  ):: std.prune(a={
+    authorization: authorization,
+    control_plane: control_plane,
+    control_plane_encryption: control_plane_encryption,
+    default_max_pods_per_node: default_max_pods_per_node,
+    external_load_balancer_ipv4_address_pools: external_load_balancer_ipv4_address_pools,
+    fleet: fleet,
+    labels: labels,
+    location: location,
+    maintenance_policy: maintenance_policy,
+    name: name,
+    networking: networking,
+    project: project,
+    release_channel: release_channel,
+    system_addons_config: system_addons_config,
+    target_version: target_version,
+    timeouts: timeouts,
+  }),
+  system_addons_config:: {
+    ingress:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.system_addons_config.ingress.new` constructs a new object with attributes and blocks configured for the `ingress`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disabled` (`bool`): Whether Ingress is disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `ipv4_vip` (`string`): Ingress VIP. When `null`, the `ipv4_vip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ingress` sub block.\n', args=[]),
+      new(
+        disabled=null,
+        ipv4_vip=null
+      ):: std.prune(a={
+        disabled: disabled,
+        ipv4_vip: ipv4_vip,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.system_addons_config.new` constructs a new object with attributes and blocks configured for the `system_addons_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ingress` (`list[obj]`): Config for the Ingress add-on which allows customers to create an Ingress\nobject to manage external access to the servers in a cluster. The add-on\nconsists of istiod and istio-ingress. When `null`, the `ingress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.ingress.new](#fn-system_addons_configingressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `system_addons_config` sub block.\n', args=[]),
+    new(
+      ingress=null
+    ):: std.prune(a={
+      ingress: ingress,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAuthorization':: d.fn(help='`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorization(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          authorization: value,
+        },
+      },
+    },
+  },
+  '#withAuthorizationMixin':: d.fn(help='`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlane(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneEncryption':: d.fn(help='`google.list[obj].withControlPlaneEncryption` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_encryption field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneEncryptionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.\n', args=[]),
+  withControlPlaneEncryption(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane_encryption: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneEncryptionMixin':: d.fn(help='`google.list[obj].withControlPlaneEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_encryption field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneEncryption](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.\n', args=[]),
+  withControlPlaneEncryptionMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane_encryption+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlaneMixin':: d.fn(help='`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlaneMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDefaultMaxPodsPerNode':: d.fn(help='`google.number.withDefaultMaxPodsPerNode` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the default_max_pods_per_node field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `default_max_pods_per_node` field.\n', args=[]),
+  withDefaultMaxPodsPerNode(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          default_max_pods_per_node: value,
+        },
+      },
+    },
+  },
+  '#withExternalLoadBalancerIpv4AddressPools':: d.fn(help='`google.list.withExternalLoadBalancerIpv4AddressPools` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the external_load_balancer_ipv4_address_pools field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `external_load_balancer_ipv4_address_pools` field.\n', args=[]),
+  withExternalLoadBalancerIpv4AddressPools(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          external_load_balancer_ipv4_address_pools: value,
+        },
+      },
+    },
+  },
+  '#withFleet':: d.fn(help='`google.list[obj].withFleet` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFleetMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet` field.\n', args=[]),
+  withFleet(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          fleet: value,
+        },
+      },
+    },
+  },
+  '#withFleetMixin':: d.fn(help='`google.list[obj].withFleetMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFleet](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet` field.\n', args=[]),
+  withFleetMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          fleet+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMaintenancePolicy':: d.fn(help='`google.list[obj].withMaintenancePolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMaintenancePolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.\n', args=[]),
+  withMaintenancePolicy(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          maintenance_policy: value,
+        },
+      },
+    },
+  },
+  '#withMaintenancePolicyMixin':: d.fn(help='`google.list[obj].withMaintenancePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenancePolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.\n', args=[]),
+  withMaintenancePolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          maintenance_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworking':: d.fn(help='`google.list[obj].withNetworking` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the networking field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkingMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `networking` field.\n', args=[]),
+  withNetworking(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          networking: value,
+        },
+      },
+    },
+  },
+  '#withNetworkingMixin':: d.fn(help='`google.list[obj].withNetworkingMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the networking field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworking](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `networking` field.\n', args=[]),
+  withNetworkingMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          networking+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withReleaseChannel':: d.fn(help='`google.string.withReleaseChannel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the release_channel field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `release_channel` field.\n', args=[]),
+  withReleaseChannel(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          release_channel: value,
+        },
+      },
+    },
+  },
+  '#withSystemAddonsConfig':: d.fn(help='`google.list[obj].withSystemAddonsConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the system_addons_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSystemAddonsConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.\n', args=[]),
+  withSystemAddonsConfig(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          system_addons_config: value,
+        },
+      },
+    },
+  },
+  '#withSystemAddonsConfigMixin':: d.fn(help='`google.list[obj].withSystemAddonsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the system_addons_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSystemAddonsConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.\n', args=[]),
+  withSystemAddonsConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          system_addons_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTargetVersion':: d.fn(help='`google.string.withTargetVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the target_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `target_version` field.\n', args=[]),
+  withTargetVersion(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          target_version: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/edgecontainer_node_pool.libsonnet b/4.x/_gen/resources/edgecontainer_node_pool.libsonnet
new file mode 100644
index 00000000..689085d0
--- /dev/null
+++ b/4.x/_gen/resources/edgecontainer_node_pool.libsonnet
@@ -0,0 +1,232 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='edgecontainer_node_pool', url='', help='`edgecontainer_node_pool` represents the `google_edgecontainer_node_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  local_disk_encryption:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_node_pool.local_disk_encryption.new` constructs a new object with attributes and blocks configured for the `local_disk_encryption`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g. projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} to use for protecting node local disks.\nIf not specified, a Google-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `local_disk_encryption` sub block.\n', args=[]),
+    new(
+      kms_key=null
+    ):: std.prune(a={
+      kms_key: kms_key,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.edgecontainer_node_pool.new` injects a new `google_edgecontainer_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.edgecontainer_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.edgecontainer_node_pool` using the reference:\n\n    $._ref.google_edgecontainer_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_edgecontainer_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.\nThe filtering language accepts strings like \u0026#34;name=\u0026lt;name\u0026gt;\u0026#34;, and is\ndocumented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the node pool.\n  - `node_count` (`number`): The number of nodes in the pool.\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: \u0026#39;us-central1-edge-customer-a\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cluster,
+    location,
+    name,
+    node_count,
+    node_location,
+    labels=null,
+    local_disk_encryption=null,
+    machine_filter=null,
+    node_config=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_edgecontainer_node_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cluster=cluster,
+      labels=labels,
+      local_disk_encryption=local_disk_encryption,
+      location=location,
+      machine_filter=machine_filter,
+      name=name,
+      node_config=node_config,
+      node_count=node_count,
+      node_location=node_location,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.edgecontainer_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_node_pool`\nTerraform resource.\n\nUnlike [google.edgecontainer_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.\nThe filtering language accepts strings like "name=<name>", and is\ndocumented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the node pool.\n  - `node_count` (`number`): The number of nodes in the pool.\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: 'us-central1-edge-customer-a'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cluster,
+    location,
+    name,
+    node_count,
+    node_location,
+    labels=null,
+    local_disk_encryption=null,
+    machine_filter=null,
+    node_config=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    cluster: cluster,
+    labels: labels,
+    local_disk_encryption: local_disk_encryption,
+    location: location,
+    machine_filter: machine_filter,
+    name: name,
+    node_config: node_config,
+    node_count: node_count,
+    node_location: node_location,
+    project: project,
+    timeouts: timeouts,
+  }),
+  node_config:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): "The Kubernetes node labels" When `null`, the `labels` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      labels=null
+    ):: std.prune(a={
+      labels: labels,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
+  withCluster(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          cluster: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocalDiskEncryption':: d.fn(help='`google.list[obj].withLocalDiskEncryption` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the local_disk_encryption field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLocalDiskEncryptionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.\n', args=[]),
+  withLocalDiskEncryption(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          local_disk_encryption: value,
+        },
+      },
+    },
+  },
+  '#withLocalDiskEncryptionMixin':: d.fn(help='`google.list[obj].withLocalDiskEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the local_disk_encryption field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLocalDiskEncryption](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.\n', args=[]),
+  withLocalDiskEncryptionMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          local_disk_encryption+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMachineFilter':: d.fn(help='`google.string.withMachineFilter` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the machine_filter field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `machine_filter` field.\n', args=[]),
+  withMachineFilter(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          machine_filter: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeCount':: d.fn(help='`google.number.withNodeCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the node_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `node_count` field.\n', args=[]),
+  withNodeCount(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_count: value,
+        },
+      },
+    },
+  },
+  '#withNodeLocation':: d.fn(help='`google.string.withNodeLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the node_location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `node_location` field.\n', args=[]),
+  withNodeLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/edgecontainer_vpn_connection.libsonnet b/4.x/_gen/resources/edgecontainer_vpn_connection.libsonnet
new file mode 100644
index 00000000..b48b2738
--- /dev/null
+++ b/4.x/_gen/resources/edgecontainer_vpn_connection.libsonnet
@@ -0,0 +1,214 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='edgecontainer_vpn_connection', url='', help='`edgecontainer_vpn_connection` represents the `google_edgecontainer_vpn_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.edgecontainer_vpn_connection.new` injects a new `google_edgecontainer_vpn_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.edgecontainer_vpn_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.edgecontainer_vpn_connection` using the reference:\n\n    $._ref.google_edgecontainer_vpn_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_edgecontainer_vpn_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.\n  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Google Cloud Platform location.\n  - `name` (`string`): The resource name of VPN connection\n  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.\nThis is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.\n  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cluster,
+    location,
+    name,
+    enable_high_availability=null,
+    labels=null,
+    nat_gateway_ip=null,
+    project=null,
+    router=null,
+    timeouts=null,
+    vpc=null,
+    vpc_project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_edgecontainer_vpn_connection',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cluster=cluster,
+      enable_high_availability=enable_high_availability,
+      labels=labels,
+      location=location,
+      name=name,
+      nat_gateway_ip=nat_gateway_ip,
+      project=project,
+      router=router,
+      timeouts=timeouts,
+      vpc=vpc,
+      vpc_project=vpc_project
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.edgecontainer_vpn_connection.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_vpn_connection`\nTerraform resource.\n\nUnlike [google.edgecontainer_vpn_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.\n  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Google Cloud Platform location.\n  - `name` (`string`): The resource name of VPN connection\n  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.\nThis is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.\n  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_vpn_connection` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cluster,
+    location,
+    name,
+    enable_high_availability=null,
+    labels=null,
+    nat_gateway_ip=null,
+    project=null,
+    router=null,
+    timeouts=null,
+    vpc=null,
+    vpc_project=null
+  ):: std.prune(a={
+    cluster: cluster,
+    enable_high_availability: enable_high_availability,
+    labels: labels,
+    location: location,
+    name: name,
+    nat_gateway_ip: nat_gateway_ip,
+    project: project,
+    router: router,
+    timeouts: timeouts,
+    vpc: vpc,
+    vpc_project: vpc_project,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_vpn_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  vpc_project:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_vpn_connection.vpc_project.new` constructs a new object with attributes and blocks configured for the `vpc_project`\nTerraform sub block.\n\n\n\n**Args**:\n  - `project_id` (`string`): The project of the VPC to connect to. If not specified, it is the same as the cluster project. When `null`, the `project_id` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_project` sub block.\n', args=[]),
+    new(
+      project_id=null
+    ):: std.prune(a={
+      project_id: project_id,
+    }),
+  },
+  '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
+  withCluster(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          cluster: value,
+        },
+      },
+    },
+  },
+  '#withEnableHighAvailability':: d.fn(help='`google.bool.withEnableHighAvailability` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_high_availability field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_high_availability` field.\n', args=[]),
+  withEnableHighAvailability(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          enable_high_availability: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNatGatewayIp':: d.fn(help='`google.string.withNatGatewayIp` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the nat_gateway_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `nat_gateway_ip` field.\n', args=[]),
+  withNatGatewayIp(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          nat_gateway_ip: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRouter':: d.fn(help='`google.string.withRouter` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the router field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `router` field.\n', args=[]),
+  withRouter(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          router: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVpc':: d.fn(help='`google.string.withVpc` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the vpc field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `vpc` field.\n', args=[]),
+  withVpc(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          vpc: value,
+        },
+      },
+    },
+  },
+  '#withVpcProject':: d.fn(help='`google.list[obj].withVpcProject` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_project field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVpcProjectMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_project` field.\n', args=[]),
+  withVpcProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          vpc_project: value,
+        },
+      },
+    },
+  },
+  '#withVpcProjectMixin':: d.fn(help='`google.list[obj].withVpcProjectMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_project field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVpcProject](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_project` field.\n', args=[]),
+  withVpcProjectMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          vpc_project+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/eventarc_trigger.libsonnet b/4.x/_gen/resources/eventarc_trigger.libsonnet
index 261d645b..228e64b5 100644
--- a/4.x/_gen/resources/eventarc_trigger.libsonnet
+++ b/4.x/_gen/resources/eventarc_trigger.libsonnet
@@ -31,14 +31,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         service: service,
       }),
     },
-    '#new':: d.fn(help='\n`google.eventarc_trigger.destination.new` constructs a new object with attributes and blocks configured for the `destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cloud_function` (`string`): [WARNING] Configuring a Cloud Function in Trigger is not supported as of today. The Cloud Function resource name. Format: projects/{project}/locations/{location}/functions/{function} When `null`, the `cloud_function` field will be omitted from the resulting object.\n  - `workflow` (`string`): The resource name of the Workflow whose Executions are triggered by the events. The Workflow resource should be deployed in the same project as the trigger. Format: `projects/{project}/locations/{location}/workflows/{workflow}` When `null`, the `workflow` field will be omitted from the resulting object.\n  - `cloud_run_service` (`list[obj]`): Cloud Run fully-managed service that receives the events. The service should be running in the same project of the trigger. When `null`, the `cloud_run_service` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.cloud_run_service.new](#fn-destinationcloud_run_servicenew) constructor.\n  - `gke` (`list[obj]`): A GKE service capable of receiving events. The service should be running in the same project as the trigger. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.gke.new](#fn-destinationgkenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `destination` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.eventarc_trigger.destination.new` constructs a new object with attributes and blocks configured for the `destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `workflow` (`string`): The resource name of the Workflow whose Executions are triggered by the events. The Workflow resource should be deployed in the same project as the trigger. Format: `projects/{project}/locations/{location}/workflows/{workflow}` When `null`, the `workflow` field will be omitted from the resulting object.\n  - `cloud_run_service` (`list[obj]`): Cloud Run fully-managed service that receives the events. The service should be running in the same project of the trigger. When `null`, the `cloud_run_service` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.cloud_run_service.new](#fn-destinationcloud_run_servicenew) constructor.\n  - `gke` (`list[obj]`): A GKE service capable of receiving events. The service should be running in the same project as the trigger. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.gke.new](#fn-destinationgkenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `destination` sub block.\n', args=[]),
     new(
-      cloud_function=null,
       cloud_run_service=null,
       gke=null,
       workflow=null
     ):: std.prune(a={
-      cloud_function: cloud_function,
       cloud_run_service: cloud_run_service,
       gke: gke,
       workflow: workflow,
@@ -56,7 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       value: value,
     }),
   },
-  '#new':: d.fn(help="\n`google.eventarc_trigger.new` injects a new `google_eventarc_trigger` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.eventarc_trigger.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.eventarc_trigger` using the reference:\n\n    $._ref.google_eventarc_trigger.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_eventarc_trigger.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.eventarc_trigger.new` injects a new `google_eventarc_trigger` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.eventarc_trigger.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.eventarc_trigger` using the reference:\n\n    $._ref.google_eventarc_trigger.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_eventarc_trigger.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -89,7 +87,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.eventarc_trigger.newAttrs` constructs a new object with attributes and blocks configured for the `eventarc_trigger`\nTerraform resource.\n\nUnlike [google.eventarc_trigger.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `eventarc_trigger` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.eventarc_trigger.newAttrs` constructs a new object with attributes and blocks configured for the `eventarc_trigger`\nTerraform resource.\n\nUnlike [google.eventarc_trigger.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `eventarc_trigger` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/filestore_backup.libsonnet b/4.x/_gen/resources/filestore_backup.libsonnet
index 2aebde10..8339c250 100644
--- a/4.x/_gen/resources/filestore_backup.libsonnet
+++ b/4.x/_gen/resources/filestore_backup.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='filestore_backup', url='', help='`filestore_backup` represents the `google_filestore_backup` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.filestore_backup.new` injects a new `google_filestore_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_backup` using the reference:\n\n    $._ref.google_filestore_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.filestore_backup.new` injects a new `google_filestore_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_backup` using the reference:\n\n    $._ref.google_filestore_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.filestore_backup.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_backup`\nTerraform resource.\n\nUnlike [google.filestore_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_backup` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.filestore_backup.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_backup`\nTerraform resource.\n\nUnlike [google.filestore_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_backup` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/filestore_instance.libsonnet b/4.x/_gen/resources/filestore_instance.libsonnet
index aa91134d..d9dc4f73 100644
--- a/4.x/_gen/resources/filestore_instance.libsonnet
+++ b/4.x/_gen/resources/filestore_instance.libsonnet
@@ -3,15 +3,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='filestore_instance', url='', help='`filestore_instance` represents the `google_filestore_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   file_shares:: {
-    '#new':: d.fn(help='\n`google.filestore_instance.file_shares.new` constructs a new object with attributes and blocks configured for the `file_shares`\nTerraform sub block.\n\n\n\n**Args**:\n  - `capacity_gb` (`number`): File share capacity in GiB. This must be at least 1024 GiB\nfor the standard tier, or 2560 GiB for the premium tier.\n  - `name` (`string`): The name of the fileshare (16 characters or less)\n  - `nfs_export_options` (`list[obj]`): Nfs Export Options. There is a limit of 10 export options per file share. When `null`, the `nfs_export_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.nfs_export_options.new](#fn-file_sharesnfs_export_optionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `file_shares` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.filestore_instance.file_shares.new` constructs a new object with attributes and blocks configured for the `file_shares`\nTerraform sub block.\n\n\n\n**Args**:\n  - `capacity_gb` (`number`): File share capacity in GiB. This must be at least 1024 GiB\nfor the standard tier, or 2560 GiB for the premium tier.\n  - `name` (`string`): The name of the fileshare (16 characters or less)\n  - `source_backup` (`string`): The resource name of the backup, in the format\nprojects/{projectId}/locations/{locationId}/backups/{backupId},\nthat this file share has been restored from. When `null`, the `source_backup` field will be omitted from the resulting object.\n  - `nfs_export_options` (`list[obj]`): Nfs Export Options. There is a limit of 10 export options per file share. When `null`, the `nfs_export_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.nfs_export_options.new](#fn-file_sharesnfs_export_optionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `file_shares` sub block.\n', args=[]),
     new(
       capacity_gb,
       name,
-      nfs_export_options=null
+      nfs_export_options=null,
+      source_backup=null
     ):: std.prune(a={
       capacity_gb: capacity_gb,
       name: name,
       nfs_export_options: nfs_export_options,
+      source_backup: source_backup,
     }),
     nfs_export_options:: {
       '#new':: d.fn(help='\n`google.filestore_instance.file_shares.nfs_export_options.new` constructs a new object with attributes and blocks configured for the `nfs_export_options`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_mode` (`string`): Either READ_ONLY, for allowing only read requests on the exported directory,\nor READ_WRITE, for allowing both read and write requests. The default is READ_WRITE. Default value: "READ_WRITE" Possible values: ["READ_ONLY", "READ_WRITE"] When `null`, the `access_mode` field will be omitted from the resulting object.\n  - `anon_gid` (`number`): An integer representing the anonymous group id with a default value of 65534.\nAnon_gid may only be set with squashMode of ROOT_SQUASH. An error will be returned\nif this field is specified for other squashMode settings. When `null`, the `anon_gid` field will be omitted from the resulting object.\n  - `anon_uid` (`number`): An integer representing the anonymous user id with a default value of 65534.\nAnon_uid may only be set with squashMode of ROOT_SQUASH. An error will be returned\nif this field is specified for other squashMode settings. When `null`, the `anon_uid` field will be omitted from the resulting object.\n  - `ip_ranges` (`list`): List of either IPv4 addresses, or ranges in CIDR notation which may mount the file share.\nOverlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned.\nThe limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions. When `null`, the `ip_ranges` field will be omitted from the resulting object.\n  - `squash_mode` (`string`): Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH,\nfor not allowing root access. The default is NO_ROOT_SQUASH. Default value: "NO_ROOT_SQUASH" Possible values: ["NO_ROOT_SQUASH", "ROOT_SQUASH"] When `null`, the `squash_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `nfs_export_options` sub block.\n', args=[]),
@@ -44,7 +46,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       reserved_ip_range: reserved_ip_range,
     }),
   },
-  '#new':: d.fn(help="\n`google.filestore_instance.new` injects a new `google_filestore_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_instance` using the reference:\n\n    $._ref.google_filestore_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.filestore_instance.new` injects a new `google_filestore_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_instance` using the reference:\n\n    $._ref.google_filestore_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL, REGIONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -77,7 +79,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.filestore_instance.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_instance`\nTerraform resource.\n\nUnlike [google.filestore_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.filestore_instance.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_instance`\nTerraform resource.\n\nUnlike [google.filestore_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL, REGIONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     tier,
diff --git a/4.x/_gen/resources/filestore_snapshot.libsonnet b/4.x/_gen/resources/filestore_snapshot.libsonnet
index 65025e34..b8fb7111 100644
--- a/4.x/_gen/resources/filestore_snapshot.libsonnet
+++ b/4.x/_gen/resources/filestore_snapshot.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='filestore_snapshot', url='', help='`filestore_snapshot` represents the `google_filestore_snapshot` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.filestore_snapshot.new` injects a new `google_filestore_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_snapshot` using the reference:\n\n    $._ref.google_filestore_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.filestore_snapshot.new` injects a new `google_filestore_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_snapshot` using the reference:\n\n    $._ref.google_filestore_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     instance,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.filestore_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_snapshot`\nTerraform resource.\n\nUnlike [google.filestore_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_snapshot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.filestore_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_snapshot`\nTerraform resource.\n\nUnlike [google.filestore_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_snapshot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     instance,
     location,
diff --git a/4.x/_gen/resources/firebaserules_release.libsonnet b/4.x/_gen/resources/firebaserules_release.libsonnet
index d5605b00..16a8b78e 100644
--- a/4.x/_gen/resources/firebaserules_release.libsonnet
+++ b/4.x/_gen/resources/firebaserules_release.libsonnet
@@ -34,15 +34,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.firebaserules_release.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.firebaserules_release.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null,
-      update=null
+      delete=null
     ):: std.prune(a={
       create: create,
       delete: delete,
-      update: update,
     }),
   },
   '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
diff --git a/4.x/_gen/resources/firestore_backup_schedule.libsonnet b/4.x/_gen/resources/firestore_backup_schedule.libsonnet
new file mode 100644
index 00000000..f36f384d
--- /dev/null
+++ b/4.x/_gen/resources/firestore_backup_schedule.libsonnet
@@ -0,0 +1,160 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='firestore_backup_schedule', url='', help='`firestore_backup_schedule` represents the `google_firestore_backup_schedule` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  daily_recurrence:: {
+    '#new':: d.fn(help='\n`google.firestore_backup_schedule.daily_recurrence.new` constructs a new object with attributes and blocks configured for the `daily_recurrence`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `daily_recurrence` sub block.\n', args=[]),
+    new(
+
+    ):: std.prune(a={}),
+  },
+  '#new':: d.fn(help="\n`google.firestore_backup_schedule.new` injects a new `google_firestore_backup_schedule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_backup_schedule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_backup_schedule` using the reference:\n\n    $._ref.google_firestore_backup_schedule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_backup_schedule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.\nA duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;.\n\nFor a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.\n  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.\n  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    retention,
+    daily_recurrence=null,
+    database=null,
+    project=null,
+    timeouts=null,
+    weekly_recurrence=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_firestore_backup_schedule',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      daily_recurrence=daily_recurrence,
+      database=database,
+      project=project,
+      retention=retention,
+      timeouts=timeouts,
+      weekly_recurrence=weekly_recurrence
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.firestore_backup_schedule.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_backup_schedule`\nTerraform resource.\n\nUnlike [google.firestore_backup_schedule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.\nA duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".\n\nFor a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.\n  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.\n  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_backup_schedule` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    retention,
+    daily_recurrence=null,
+    database=null,
+    project=null,
+    timeouts=null,
+    weekly_recurrence=null
+  ):: std.prune(a={
+    daily_recurrence: daily_recurrence,
+    database: database,
+    project: project,
+    retention: retention,
+    timeouts: timeouts,
+    weekly_recurrence: weekly_recurrence,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.firestore_backup_schedule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  weekly_recurrence:: {
+    '#new':: d.fn(help='\n`google.firestore_backup_schedule.weekly_recurrence.new` constructs a new object with attributes and blocks configured for the `weekly_recurrence`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`string`): The day of week to run. Possible values: ["DAY_OF_WEEK_UNSPECIFIED", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `weekly_recurrence` sub block.\n', args=[]),
+    new(
+      day=null
+    ):: std.prune(a={
+      day: day,
+    }),
+  },
+  '#withDailyRecurrence':: d.fn(help='`google.list[obj].withDailyRecurrence` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the daily_recurrence field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDailyRecurrenceMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.\n', args=[]),
+  withDailyRecurrence(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          daily_recurrence: value,
+        },
+      },
+    },
+  },
+  '#withDailyRecurrenceMixin':: d.fn(help='`google.list[obj].withDailyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the daily_recurrence field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDailyRecurrence](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.\n', args=[]),
+  withDailyRecurrenceMixin(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          daily_recurrence+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDatabase':: d.fn(help='`google.string.withDatabase` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the database field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `database` field.\n', args=[]),
+  withDatabase(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          database: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRetention':: d.fn(help='`google.string.withRetention` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the retention field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `retention` field.\n', args=[]),
+  withRetention(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          retention: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withWeeklyRecurrence':: d.fn(help='`google.list[obj].withWeeklyRecurrence` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the weekly_recurrence field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withWeeklyRecurrenceMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.\n', args=[]),
+  withWeeklyRecurrence(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          weekly_recurrence: value,
+        },
+      },
+    },
+  },
+  '#withWeeklyRecurrenceMixin':: d.fn(help='`google.list[obj].withWeeklyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the weekly_recurrence field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withWeeklyRecurrence](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.\n', args=[]),
+  withWeeklyRecurrenceMixin(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          weekly_recurrence+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/firestore_database.libsonnet b/4.x/_gen/resources/firestore_database.libsonnet
index b80b7ca9..98f67d93 100644
--- a/4.x/_gen/resources/firestore_database.libsonnet
+++ b/4.x/_gen/resources/firestore_database.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='firestore_database', url='', help='`firestore_database` represents the `google_firestore_database` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.firestore_database.new` injects a new `google_firestore_database` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_database.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_database` using the reference:\n\n    $._ref.google_firestore_database.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_database.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_engine_integration_mode` (`string`): The App Engine integration mode to use for this database. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `app_engine_integration_mode` field will be omitted from the resulting object.\n  - `concurrency_mode` (`string`): The concurrency control mode to use for this database. Possible values: [\u0026#34;OPTIMISTIC\u0026#34;, \u0026#34;PESSIMISTIC\u0026#34;, \u0026#34;OPTIMISTIC_WITH_ENTITY_GROUPS\u0026#34;] When `null`, the `concurrency_mode` field will be omitted from the resulting object.\n  - `delete_protection_state` (`string`): State of delete protection for the database. Possible values: [\u0026#34;DELETE_PROTECTION_STATE_UNSPECIFIED\u0026#34;, \u0026#34;DELETE_PROTECTION_ENABLED\u0026#34;, \u0026#34;DELETE_PROTECTION_DISABLED\u0026#34;] When `null`, the `delete_protection_state` field will be omitted from the resulting object.\n  - `location_id` (`string`): The location of the database. Available locations are listed at\nhttps://cloud.google.com/firestore/docs/locations.\n  - `name` (`string`): The ID to use for the database, which will become the final\ncomponent of the database\u0026#39;s resource name. This value should be 4-63\ncharacters. Valid characters are /[a-z][0-9]-/ with first character\na letter and the last a letter or a number. Must not be\nUUID-like /[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/.\n\u0026#34;(default)\u0026#34; database id is also valid.\n  - `point_in_time_recovery_enablement` (`string`): Whether to enable the PITR feature on this database.\nIf \u0026#39;POINT_IN_TIME_RECOVERY_ENABLED\u0026#39; is selected, reads are supported on selected versions of the data from within the past 7 days.\nversionRetentionPeriod and earliestVersionTime can be used to determine the supported versions. These include reads against any timestamp within the past hour\nand reads against 1-minute snapshots beyond 1 hour and within 7 days.\nIf \u0026#39;POINT_IN_TIME_RECOVERY_DISABLED\u0026#39; is selected, reads are supported on any version of the data from within the past 1 hour. Default value: \u0026#34;POINT_IN_TIME_RECOVERY_DISABLED\u0026#34; Possible values: [\u0026#34;POINT_IN_TIME_RECOVERY_ENABLED\u0026#34;, \u0026#34;POINT_IN_TIME_RECOVERY_DISABLED\u0026#34;] When `null`, the `point_in_time_recovery_enablement` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the database.\nSee https://cloud.google.com/datastore/docs/firestore-or-datastore\nfor information about how to choose. Possible values: [\u0026#34;FIRESTORE_NATIVE\u0026#34;, \u0026#34;DATASTORE_MODE\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_database.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.firestore_database.new` injects a new `google_firestore_database` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_database.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_database` using the reference:\n\n    $._ref.google_firestore_database.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_database.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_engine_integration_mode` (`string`): The App Engine integration mode to use for this database. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `app_engine_integration_mode` field will be omitted from the resulting object.\n  - `concurrency_mode` (`string`): The concurrency control mode to use for this database. Possible values: [\u0026#34;OPTIMISTIC\u0026#34;, \u0026#34;PESSIMISTIC\u0026#34;, \u0026#34;OPTIMISTIC_WITH_ENTITY_GROUPS\u0026#34;] When `null`, the `concurrency_mode` field will be omitted from the resulting object.\n  - `delete_protection_state` (`string`): State of delete protection for the database.\nWhen delete protection is enabled, this database cannot be deleted.\nThe default value is \u0026#39;DELETE_PROTECTION_STATE_UNSPECIFIED\u0026#39;, which is currently equivalent to \u0026#39;DELETE_PROTECTION_DISABLED\u0026#39;.\n**Note:** Additionally, to delete this database using \u0026#39;terraform destroy\u0026#39;, \u0026#39;deletion_policy\u0026#39; must be set to \u0026#39;DELETE\u0026#39;. Possible values: [\u0026#34;DELETE_PROTECTION_STATE_UNSPECIFIED\u0026#34;, \u0026#34;DELETE_PROTECTION_ENABLED\u0026#34;, \u0026#34;DELETE_PROTECTION_DISABLED\u0026#34;] When `null`, the `delete_protection_state` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Deletion behavior for this database.\nIf the deletion policy is \u0026#39;ABANDON\u0026#39;, the database will be removed from Terraform state but not deleted from Google Cloud upon destruction.\nIf the deletion policy is \u0026#39;DELETE\u0026#39;, the database will both be removed from Terraform state and deleted from Google Cloud upon destruction.\nThe default value is \u0026#39;ABANDON\u0026#39;.\nSee also \u0026#39;delete_protection\u0026#39;. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `location_id` (`string`): The location of the database. Available locations are listed at\nhttps://cloud.google.com/firestore/docs/locations.\n  - `name` (`string`): The ID to use for the database, which will become the final\ncomponent of the database\u0026#39;s resource name. This value should be 4-63\ncharacters. Valid characters are /[a-z][0-9]-/ with first character\na letter and the last a letter or a number. Must not be\nUUID-like /[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/.\n\u0026#34;(default)\u0026#34; database id is also valid.\n  - `point_in_time_recovery_enablement` (`string`): Whether to enable the PITR feature on this database.\nIf \u0026#39;POINT_IN_TIME_RECOVERY_ENABLED\u0026#39; is selected, reads are supported on selected versions of the data from within the past 7 days.\nversionRetentionPeriod and earliestVersionTime can be used to determine the supported versions. These include reads against any timestamp within the past hour\nand reads against 1-minute snapshots beyond 1 hour and within 7 days.\nIf \u0026#39;POINT_IN_TIME_RECOVERY_DISABLED\u0026#39; is selected, reads are supported on any version of the data from within the past 1 hour. Default value: \u0026#34;POINT_IN_TIME_RECOVERY_DISABLED\u0026#34; Possible values: [\u0026#34;POINT_IN_TIME_RECOVERY_ENABLED\u0026#34;, \u0026#34;POINT_IN_TIME_RECOVERY_DISABLED\u0026#34;] When `null`, the `point_in_time_recovery_enablement` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the database.\nSee https://cloud.google.com/datastore/docs/firestore-or-datastore\nfor information about how to choose. Possible values: [\u0026#34;FIRESTORE_NATIVE\u0026#34;, \u0026#34;DATASTORE_MODE\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_database.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location_id,
@@ -11,6 +11,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     app_engine_integration_mode=null,
     concurrency_mode=null,
     delete_protection_state=null,
+    deletion_policy=null,
     point_in_time_recovery_enablement=null,
     project=null,
     timeouts=null,
@@ -22,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       app_engine_integration_mode=app_engine_integration_mode,
       concurrency_mode=concurrency_mode,
       delete_protection_state=delete_protection_state,
+      deletion_policy=deletion_policy,
       location_id=location_id,
       name=name,
       point_in_time_recovery_enablement=point_in_time_recovery_enablement,
@@ -31,7 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.firestore_database.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_database`\nTerraform resource.\n\nUnlike [google.firestore_database.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_engine_integration_mode` (`string`): The App Engine integration mode to use for this database. Possible values: ["ENABLED", "DISABLED"] When `null`, the `app_engine_integration_mode` field will be omitted from the resulting object.\n  - `concurrency_mode` (`string`): The concurrency control mode to use for this database. Possible values: ["OPTIMISTIC", "PESSIMISTIC", "OPTIMISTIC_WITH_ENTITY_GROUPS"] When `null`, the `concurrency_mode` field will be omitted from the resulting object.\n  - `delete_protection_state` (`string`): State of delete protection for the database. Possible values: ["DELETE_PROTECTION_STATE_UNSPECIFIED", "DELETE_PROTECTION_ENABLED", "DELETE_PROTECTION_DISABLED"] When `null`, the `delete_protection_state` field will be omitted from the resulting object.\n  - `location_id` (`string`): The location of the database. Available locations are listed at\nhttps://cloud.google.com/firestore/docs/locations.\n  - `name` (`string`): The ID to use for the database, which will become the final\ncomponent of the database's resource name. This value should be 4-63\ncharacters. Valid characters are /[a-z][0-9]-/ with first character\na letter and the last a letter or a number. Must not be\nUUID-like /[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/.\n"(default)" database id is also valid.\n  - `point_in_time_recovery_enablement` (`string`): Whether to enable the PITR feature on this database.\nIf 'POINT_IN_TIME_RECOVERY_ENABLED' is selected, reads are supported on selected versions of the data from within the past 7 days.\nversionRetentionPeriod and earliestVersionTime can be used to determine the supported versions. These include reads against any timestamp within the past hour\nand reads against 1-minute snapshots beyond 1 hour and within 7 days.\nIf 'POINT_IN_TIME_RECOVERY_DISABLED' is selected, reads are supported on any version of the data from within the past 1 hour. Default value: "POINT_IN_TIME_RECOVERY_DISABLED" Possible values: ["POINT_IN_TIME_RECOVERY_ENABLED", "POINT_IN_TIME_RECOVERY_DISABLED"] When `null`, the `point_in_time_recovery_enablement` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the database.\nSee https://cloud.google.com/datastore/docs/firestore-or-datastore\nfor information about how to choose. Possible values: ["FIRESTORE_NATIVE", "DATASTORE_MODE"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_database.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_database` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.firestore_database.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_database`\nTerraform resource.\n\nUnlike [google.firestore_database.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_engine_integration_mode` (`string`): The App Engine integration mode to use for this database. Possible values: ["ENABLED", "DISABLED"] When `null`, the `app_engine_integration_mode` field will be omitted from the resulting object.\n  - `concurrency_mode` (`string`): The concurrency control mode to use for this database. Possible values: ["OPTIMISTIC", "PESSIMISTIC", "OPTIMISTIC_WITH_ENTITY_GROUPS"] When `null`, the `concurrency_mode` field will be omitted from the resulting object.\n  - `delete_protection_state` (`string`): State of delete protection for the database.\nWhen delete protection is enabled, this database cannot be deleted.\nThe default value is 'DELETE_PROTECTION_STATE_UNSPECIFIED', which is currently equivalent to 'DELETE_PROTECTION_DISABLED'.\n**Note:** Additionally, to delete this database using 'terraform destroy', 'deletion_policy' must be set to 'DELETE'. Possible values: ["DELETE_PROTECTION_STATE_UNSPECIFIED", "DELETE_PROTECTION_ENABLED", "DELETE_PROTECTION_DISABLED"] When `null`, the `delete_protection_state` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Deletion behavior for this database.\nIf the deletion policy is 'ABANDON', the database will be removed from Terraform state but not deleted from Google Cloud upon destruction.\nIf the deletion policy is 'DELETE', the database will both be removed from Terraform state and deleted from Google Cloud upon destruction.\nThe default value is 'ABANDON'.\nSee also 'delete_protection'. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `location_id` (`string`): The location of the database. Available locations are listed at\nhttps://cloud.google.com/firestore/docs/locations.\n  - `name` (`string`): The ID to use for the database, which will become the final\ncomponent of the database's resource name. This value should be 4-63\ncharacters. Valid characters are /[a-z][0-9]-/ with first character\na letter and the last a letter or a number. Must not be\nUUID-like /[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/.\n"(default)" database id is also valid.\n  - `point_in_time_recovery_enablement` (`string`): Whether to enable the PITR feature on this database.\nIf 'POINT_IN_TIME_RECOVERY_ENABLED' is selected, reads are supported on selected versions of the data from within the past 7 days.\nversionRetentionPeriod and earliestVersionTime can be used to determine the supported versions. These include reads against any timestamp within the past hour\nand reads against 1-minute snapshots beyond 1 hour and within 7 days.\nIf 'POINT_IN_TIME_RECOVERY_DISABLED' is selected, reads are supported on any version of the data from within the past 1 hour. Default value: "POINT_IN_TIME_RECOVERY_DISABLED" Possible values: ["POINT_IN_TIME_RECOVERY_ENABLED", "POINT_IN_TIME_RECOVERY_DISABLED"] When `null`, the `point_in_time_recovery_enablement` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the database.\nSee https://cloud.google.com/datastore/docs/firestore-or-datastore\nfor information about how to choose. Possible values: ["FIRESTORE_NATIVE", "DATASTORE_MODE"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_database.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_database` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location_id,
     name,
@@ -39,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     app_engine_integration_mode=null,
     concurrency_mode=null,
     delete_protection_state=null,
+    deletion_policy=null,
     point_in_time_recovery_enablement=null,
     project=null,
     timeouts=null
@@ -46,6 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     app_engine_integration_mode: app_engine_integration_mode,
     concurrency_mode: concurrency_mode,
     delete_protection_state: delete_protection_state,
+    deletion_policy: deletion_policy,
     location_id: location_id,
     name: name,
     point_in_time_recovery_enablement: point_in_time_recovery_enablement,
@@ -95,6 +99,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDeletionPolicy':: d.fn(help='`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deletion_policy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deletion_policy` field.\n', args=[]),
+  withDeletionPolicy(resourceLabel, value): {
+    resource+: {
+      google_firestore_database+: {
+        [resourceLabel]+: {
+          deletion_policy: value,
+        },
+      },
+    },
+  },
   '#withLocationId':: d.fn(help='`google.string.withLocationId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location_id` field.\n', args=[]),
   withLocationId(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/firestore_field.libsonnet b/4.x/_gen/resources/firestore_field.libsonnet
index 312406b3..678c23bb 100644
--- a/4.x/_gen/resources/firestore_field.libsonnet
+++ b/4.x/_gen/resources/firestore_field.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       indexes: indexes,
     }),
   },
-  '#new':: d.fn(help="\n`google.firestore_field.new` injects a new `google_firestore_field` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_field.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_field` using the reference:\n\n    $._ref.google_firestore_field.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_field.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.firestore_field.new` injects a new `google_firestore_field` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_field.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_field` using the reference:\n\n    $._ref.google_firestore_field.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_field.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. \u0026#39;ttl_config {}\u0026#39;), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     collection,
@@ -47,7 +47,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.firestore_field.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_field`\nTerraform resource.\n\nUnlike [google.firestore_field.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_field` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.firestore_field.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_field`\nTerraform resource.\n\nUnlike [google.firestore_field.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. 'ttl_config {}'), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_field` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     collection,
     field,
diff --git a/4.x/_gen/resources/firestore_index.libsonnet b/4.x/_gen/resources/firestore_index.libsonnet
index 3f30167f..ca82f0b1 100644
--- a/4.x/_gen/resources/firestore_index.libsonnet
+++ b/4.x/_gen/resources/firestore_index.libsonnet
@@ -14,10 +14,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       order: order,
     }),
   },
-  '#new':: d.fn(help="\n`google.firestore_index.new` injects a new `google_firestore_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_index` using the reference:\n\n    $._ref.google_firestore_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: \u0026#34;COLLECTION\u0026#34; Possible values: [\u0026#34;COLLECTION\u0026#34;, \u0026#34;COLLECTION_GROUP\u0026#34;] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path \u0026#39;__name__\u0026#39;. If, on creation, \u0026#39;__name__\u0026#39; was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the \u0026#39;__name__\u0026#39; will be\nordered \u0026#39;\u0026#34;ASCENDING\u0026#34;\u0026#39; (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.firestore_index.new` injects a new `google_firestore_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_index` using the reference:\n\n    $._ref.google_firestore_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `api_scope` (`string`): The API scope at which a query is run. Default value: \u0026#34;ANY_API\u0026#34; Possible values: [\u0026#34;ANY_API\u0026#34;, \u0026#34;DATASTORE_MODE_API\u0026#34;] When `null`, the `api_scope` field will be omitted from the resulting object.\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: \u0026#34;COLLECTION\u0026#34; Possible values: [\u0026#34;COLLECTION\u0026#34;, \u0026#34;COLLECTION_GROUP\u0026#34;, \u0026#34;COLLECTION_RECURSIVE\u0026#34;] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path \u0026#39;__name__\u0026#39;. If, on creation, \u0026#39;__name__\u0026#39; was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the \u0026#39;__name__\u0026#39; will be\nordered \u0026#39;\u0026#34;ASCENDING\u0026#34;\u0026#39; (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     collection,
+    api_scope=null,
     database=null,
     fields=null,
     project=null,
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_firestore_index',
     label=resourceLabel,
     attrs=self.newAttrs(
+      api_scope=api_scope,
       collection=collection,
       database=database,
       fields=fields,
@@ -37,15 +39,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.firestore_index.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_index`\nTerraform resource.\n\nUnlike [google.firestore_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP"] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path '__name__'. If, on creation, '__name__' was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the '__name__' will be\nordered '"ASCENDING"' (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_index` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.firestore_index.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_index`\nTerraform resource.\n\nUnlike [google.firestore_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `api_scope` (`string`): The API scope at which a query is run. Default value: "ANY_API" Possible values: ["ANY_API", "DATASTORE_MODE_API"] When `null`, the `api_scope` field will be omitted from the resulting object.\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP", "COLLECTION_RECURSIVE"] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path '__name__'. If, on creation, '__name__' was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the '__name__' will be\nordered '"ASCENDING"' (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_index` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     collection,
+    api_scope=null,
     database=null,
     fields=null,
     project=null,
     query_scope=null,
     timeouts=null
   ):: std.prune(a={
+    api_scope: api_scope,
     collection: collection,
     database: database,
     fields: fields,
@@ -63,6 +67,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       delete: delete,
     }),
   },
+  '#withApiScope':: d.fn(help='`google.string.withApiScope` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the api_scope field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `api_scope` field.\n', args=[]),
+  withApiScope(resourceLabel, value): {
+    resource+: {
+      google_firestore_index+: {
+        [resourceLabel]+: {
+          api_scope: value,
+        },
+      },
+    },
+  },
   '#withCollection':: d.fn(help='`google.string.withCollection` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the collection field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `collection` field.\n', args=[]),
   withCollection(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/game_services_game_server_cluster.libsonnet b/4.x/_gen/resources/game_services_game_server_cluster.libsonnet
deleted file mode 100644
index 49beb8c8..00000000
--- a/4.x/_gen/resources/game_services_game_server_cluster.libsonnet
+++ /dev/null
@@ -1,182 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_cluster', url='', help='`game_services_game_server_cluster` represents the `google_game_services_game_server_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  connection_info:: {
-    gke_cluster_reference:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new` constructs a new object with attributes and blocks configured for the `gke_cluster_reference`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cluster` (`string`): The full or partial name of a GKE cluster, using one of the following\nforms:\n\n* 'projects/{project_id}/locations/{location}/clusters/{cluster_id}'\n* 'locations/{location}/clusters/{cluster_id}'\n* '{cluster_id}'\n\nIf project and location are not specified, the project and location of the\nGameServerCluster resource are used to generate the full name of the\nGKE cluster.\n\n**Returns**:\n  - An attribute object that represents the `gke_cluster_reference` sub block.\n', args=[]),
-      new(
-        cluster
-      ):: std.prune(a={
-        cluster: cluster,
-      }),
-    },
-    '#new':: d.fn(help='\n`google.game_services_game_server_cluster.connection_info.new` constructs a new object with attributes and blocks configured for the `connection_info`\nTerraform sub block.\n\n\n\n**Args**:\n  - `namespace` (`string`): Namespace designated on the game server cluster where the game server\ninstances will be created. The namespace existence will be validated\nduring creation.\n  - `gke_cluster_reference` (`list[obj]`): Reference of the GKE cluster where the game servers are installed. When `null`, the `gke_cluster_reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new](#fn-connection_infogke_cluster_referencenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `connection_info` sub block.\n', args=[]),
-    new(
-      namespace,
-      gke_cluster_reference=null
-    ):: std.prune(a={
-      gke_cluster_reference: gke_cluster_reference,
-      namespace: namespace,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.game_services_game_server_cluster.new` injects a new `google_game_services_game_server_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_cluster` using the reference:\n\n    $._ref.google_game_services_game_server_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster_id` (`string`): Required. The resource name of the game server cluster\n  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): The realm id of the game server realm.\n  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to\nmanage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    cluster_id,
-    realm_id,
-    connection_info=null,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_cluster',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      cluster_id=cluster_id,
-      connection_info=connection_info,
-      description=description,
-      labels=labels,
-      location=location,
-      project=project,
-      realm_id=realm_id,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_cluster`\nTerraform resource.\n\nUnlike [google.game_services_game_server_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster_id` (`string`): Required. The resource name of the game server cluster\n  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): The realm id of the game server realm.\n  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to\nmanage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_cluster` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    cluster_id,
-    realm_id,
-    connection_info=null,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    cluster_id: cluster_id,
-    connection_info: connection_info,
-    description: description,
-    labels: labels,
-    location: location,
-    project: project,
-    realm_id: realm_id,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withClusterId':: d.fn(help='`google.string.withClusterId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster_id` field.\n', args=[]),
-  withClusterId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          cluster_id: value,
-        },
-      },
-    },
-  },
-  '#withConnectionInfo':: d.fn(help='`google.list[obj].withConnectionInfo` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the connection_info field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConnectionInfoMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `connection_info` field.\n', args=[]),
-  withConnectionInfo(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          connection_info: value,
-        },
-      },
-    },
-  },
-  '#withConnectionInfoMixin':: d.fn(help='`google.list[obj].withConnectionInfoMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the connection_info field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withConnectionInfo](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `connection_info` field.\n', args=[]),
-  withConnectionInfoMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          connection_info+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRealmId':: d.fn(help='`google.string.withRealmId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the realm_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `realm_id` field.\n', args=[]),
-  withRealmId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          realm_id: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_game_server_config.libsonnet b/4.x/_gen/resources/game_services_game_server_config.libsonnet
deleted file mode 100644
index 0ab7d3a0..00000000
--- a/4.x/_gen/resources/game_services_game_server_config.libsonnet
+++ /dev/null
@@ -1,232 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_config', url='', help='`game_services_game_server_config` represents the `google_game_services_game_server_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  fleet_configs:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_config.fleet_configs.new` constructs a new object with attributes and blocks configured for the `fleet_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `fleet_spec` (`string`): The fleet spec, which is sent to Agones to configure fleet.\nThe spec can be passed as inline json but it is recommended to use a file reference\ninstead. File references can contain the json or yaml format of the fleet spec. Eg:\n\n* fleet_spec = jsonencode(yamldecode(file("fleet_configs.yaml")))\n* fleet_spec = file("fleet_configs.json")\n\nThe format of the spec can be found :\n'https://agones.dev/site/docs/reference/fleet/'.\n  - `name` (`string`): The name of the FleetConfig. When `null`, the `name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `fleet_configs` sub block.\n', args=[]),
-    new(
-      fleet_spec,
-      name=null
-    ):: std.prune(a={
-      fleet_spec: fleet_spec,
-      name: name,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.game_services_game_server_config.new` injects a new `google_game_services_game_server_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_config` using the reference:\n\n    $._ref.google_game_services_game_server_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config_id` (`string`): A unique id for the deployment config.\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server config. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there\nwill be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.\n  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    config_id,
-    deployment_id,
-    description=null,
-    fleet_configs=null,
-    labels=null,
-    location=null,
-    project=null,
-    scaling_configs=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_config',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      config_id=config_id,
-      deployment_id=deployment_id,
-      description=description,
-      fleet_configs=fleet_configs,
-      labels=labels,
-      location=location,
-      project=project,
-      scaling_configs=scaling_configs,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_config.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_config`\nTerraform resource.\n\nUnlike [google.game_services_game_server_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config_id` (`string`): A unique id for the deployment config.\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server config. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there\nwill be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.\n  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_config` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    config_id,
-    deployment_id,
-    description=null,
-    fleet_configs=null,
-    labels=null,
-    location=null,
-    project=null,
-    scaling_configs=null,
-    timeouts=null
-  ):: std.prune(a={
-    config_id: config_id,
-    deployment_id: deployment_id,
-    description: description,
-    fleet_configs: fleet_configs,
-    labels: labels,
-    location: location,
-    project: project,
-    scaling_configs: scaling_configs,
-    timeouts: timeouts,
-  }),
-  scaling_configs:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_config.scaling_configs.new` constructs a new object with attributes and blocks configured for the `scaling_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `fleet_autoscaler_spec` (`string`): Fleet autoscaler spec, which is sent to Agones.\nExample spec can be found :\nhttps://agones.dev/site/docs/reference/fleetautoscaler/\n  - `name` (`string`): The name of the ScalingConfig\n  - `schedules` (`list[obj]`): The schedules to which this scaling config applies. When `null`, the `schedules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.schedules.new](#fn-scaling_configsschedulesnew) constructor.\n  - `selectors` (`list[obj]`): Labels used to identify the clusters to which this scaling config\napplies. A cluster is subject to this scaling config if its labels match\nany of the selector entries. When `null`, the `selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.selectors.new](#fn-scaling_configsselectorsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `scaling_configs` sub block.\n', args=[]),
-    new(
-      fleet_autoscaler_spec,
-      name,
-      schedules=null,
-      selectors=null
-    ):: std.prune(a={
-      fleet_autoscaler_spec: fleet_autoscaler_spec,
-      name: name,
-      schedules: schedules,
-      selectors: selectors,
-    }),
-    schedules:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_config.scaling_configs.schedules.new` constructs a new object with attributes and blocks configured for the `schedules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cron_job_duration` (`string`): The duration for the cron job event. The duration of the event is effective\nafter the cron job's start time.\n\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `cron_job_duration` field will be omitted from the resulting object.\n  - `cron_spec` (`string`): The cron definition of the scheduled event. See\nhttps://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as\ndefined by the realm. When `null`, the `cron_spec` field will be omitted from the resulting object.\n  - `end_time` (`string`): The end time of the event.\n\nA timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `end_time` field will be omitted from the resulting object.\n  - `start_time` (`string`): The start time of the event.\n\nA timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `start_time` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `schedules` sub block.\n', args=[]),
-      new(
-        cron_job_duration=null,
-        cron_spec=null,
-        end_time=null,
-        start_time=null
-      ):: std.prune(a={
-        cron_job_duration: cron_job_duration,
-        cron_spec: cron_spec,
-        end_time: end_time,
-        start_time: start_time,
-      }),
-    },
-    selectors:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_config.scaling_configs.selectors.new` constructs a new object with attributes and blocks configured for the `selectors`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): Set of labels to group by. When `null`, the `labels` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `selectors` sub block.\n', args=[]),
-      new(
-        labels=null
-      ):: std.prune(a={
-        labels: labels,
-      }),
-    },
-  },
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-    }),
-  },
-  '#withConfigId':: d.fn(help='`google.string.withConfigId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the config_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `config_id` field.\n', args=[]),
-  withConfigId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          config_id: value,
-        },
-      },
-    },
-  },
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withFleetConfigs':: d.fn(help='`google.list[obj].withFleetConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFleetConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.\n', args=[]),
-  withFleetConfigs(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          fleet_configs: value,
-        },
-      },
-    },
-  },
-  '#withFleetConfigsMixin':: d.fn(help='`google.list[obj].withFleetConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFleetConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.\n', args=[]),
-  withFleetConfigsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          fleet_configs+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withScalingConfigs':: d.fn(help='`google.list[obj].withScalingConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the scaling_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withScalingConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.\n', args=[]),
-  withScalingConfigs(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          scaling_configs: value,
-        },
-      },
-    },
-  },
-  '#withScalingConfigsMixin':: d.fn(help='`google.list[obj].withScalingConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the scaling_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withScalingConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.\n', args=[]),
-  withScalingConfigsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          scaling_configs+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_game_server_deployment.libsonnet b/4.x/_gen/resources/game_services_game_server_deployment.libsonnet
deleted file mode 100644
index 7fabe285..00000000
--- a/4.x/_gen/resources/game_services_game_server_deployment.libsonnet
+++ /dev/null
@@ -1,126 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_deployment', url='', help='`game_services_game_server_deployment` represents the `google_game_services_game_server_deployment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.game_services_game_server_deployment.new` injects a new `google_game_services_game_server_deployment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_deployment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_deployment` using the reference:\n\n    $._ref.google_game_services_game_server_deployment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_deployment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    deployment_id,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_deployment',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      deployment_id=deployment_id,
-      description=description,
-      labels=labels,
-      location=location,
-      project=project,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_deployment.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment`\nTerraform resource.\n\nUnlike [google.game_services_game_server_deployment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    deployment_id,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    deployment_id: deployment_id,
-    description: description,
-    labels: labels,
-    location: location,
-    project: project,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_deployment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_game_server_deployment_rollout.libsonnet b/4.x/_gen/resources/game_services_game_server_deployment_rollout.libsonnet
deleted file mode 100644
index 7d8aed80..00000000
--- a/4.x/_gen/resources/game_services_game_server_deployment_rollout.libsonnet
+++ /dev/null
@@ -1,140 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_deployment_rollout', url='', help='`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  game_server_config_overrides:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.game_server_config_overrides.new` constructs a new object with attributes and blocks configured for the `game_server_config_overrides`\nTerraform sub block.\n\n\n\n**Args**:\n  - `config_version` (`string`): Version of the configuration. When `null`, the `config_version` field will be omitted from the resulting object.\n  - `realms_selector` (`list[obj]`): Selection by realms. When `null`, the `realms_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new](#fn-game_server_config_overridesrealms_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `game_server_config_overrides` sub block.\n', args=[]),
-    new(
-      config_version=null,
-      realms_selector=null
-    ):: std.prune(a={
-      config_version: config_version,
-      realms_selector: realms_selector,
-    }),
-    realms_selector:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new` constructs a new object with attributes and blocks configured for the `realms_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `realms` (`list`): List of realms to match against. When `null`, the `realms` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `realms_selector` sub block.\n', args=[]),
-      new(
-        realms=null
-      ):: std.prune(a={
-        realms: realms,
-      }),
-    },
-  },
-  '#new':: d.fn(help="\n`google.game_services_game_server_deployment_rollout.new` injects a new `google_game_services_game_server_deployment_rollout` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_deployment_rollout.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_deployment_rollout` using the reference:\n\n    $._ref.google_game_services_game_server_deployment_rollout.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_deployment_rollout.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_game_server_config` (`string`): This field points to the game server config that is\napplied by default to all realms and clusters. For example,\n\n\u0026#39;projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config\u0026#39;.\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config\noverrides. The overrides are processed in the order they are listed. As\nsoon as a match is found for a cluster, the rest of the list is not\nprocessed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    default_game_server_config,
-    deployment_id,
-    game_server_config_overrides=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_deployment_rollout',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      default_game_server_config=default_game_server_config,
-      deployment_id=deployment_id,
-      game_server_config_overrides=game_server_config_overrides,
-      project=project,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`\nTerraform resource.\n\nUnlike [google.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_game_server_config` (`string`): This field points to the game server config that is\napplied by default to all realms and clusters. For example,\n\n'projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config'.\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config\noverrides. The overrides are processed in the order they are listed. As\nsoon as a match is found for a cluster, the rest of the list is not\nprocessed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment_rollout` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    default_game_server_config,
-    deployment_id,
-    game_server_config_overrides=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    default_game_server_config: default_game_server_config,
-    deployment_id: deployment_id,
-    game_server_config_overrides: game_server_config_overrides,
-    project: project,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withDefaultGameServerConfig':: d.fn(help='`google.string.withDefaultGameServerConfig` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the default_game_server_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `default_game_server_config` field.\n', args=[]),
-  withDefaultGameServerConfig(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          default_game_server_config: value,
-        },
-      },
-    },
-  },
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-  '#withGameServerConfigOverrides':: d.fn(help='`google.list[obj].withGameServerConfigOverrides` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the game_server_config_overrides field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGameServerConfigOverridesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.\n', args=[]),
-  withGameServerConfigOverrides(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          game_server_config_overrides: value,
-        },
-      },
-    },
-  },
-  '#withGameServerConfigOverridesMixin':: d.fn(help='`google.list[obj].withGameServerConfigOverridesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the game_server_config_overrides field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGameServerConfigOverrides](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.\n', args=[]),
-  withGameServerConfigOverridesMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          game_server_config_overrides+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/gke_backup_backup_plan.libsonnet b/4.x/_gen/resources/gke_backup_backup_plan.libsonnet
index 21bdf4c0..ce618465 100644
--- a/4.x/_gen/resources/gke_backup_backup_plan.libsonnet
+++ b/4.x/_gen/resources/gke_backup_backup_plan.libsonnet
@@ -64,7 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       paused: paused,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_backup_backup_plan.new` injects a new `google_gke_backup_backup_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_backup_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_backup_plan` using the reference:\n\n    $._ref.google_gke_backup_backup_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_backup_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_backup_backup_plan.new` injects a new `google_gke_backup_backup_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_backup_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_backup_plan` using the reference:\n\n    $._ref.google_gke_backup_backup_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_backup_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -97,7 +97,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_backup_backup_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_backup_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_backup_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_backup_plan` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_backup_backup_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_backup_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_backup_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_backup_plan` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     location,
diff --git a/4.x/_gen/resources/gke_backup_restore_plan.libsonnet b/4.x/_gen/resources/gke_backup_restore_plan.libsonnet
index f126671e..548ff07e 100644
--- a/4.x/_gen/resources/gke_backup_restore_plan.libsonnet
+++ b/4.x/_gen/resources/gke_backup_restore_plan.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_backup_restore_plan', url='', help='`gke_backup_restore_plan` represents the `google_gke_backup_restore_plan` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_backup_restore_plan.new` injects a new `google_gke_backup_restore_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_restore_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_restore_plan` using the reference:\n\n    $._ref.google_gke_backup_restore_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_restore_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_backup_restore_plan.new` injects a new `google_gke_backup_restore_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_restore_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_restore_plan` using the reference:\n\n    $._ref.google_gke_backup_restore_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_restore_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backup_plan,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_backup_restore_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_restore_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_restore_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_restore_plan` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_backup_restore_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_restore_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_restore_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_restore_plan` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backup_plan,
     cluster,
diff --git a/4.x/_gen/resources/gke_hub_feature.libsonnet b/4.x/_gen/resources/gke_hub_feature.libsonnet
index 3b691058..0e04af49 100644
--- a/4.x/_gen/resources/gke_hub_feature.libsonnet
+++ b/4.x/_gen/resources/gke_hub_feature.libsonnet
@@ -2,10 +2,225 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_feature', url='', help='`gke_hub_feature` represents the `google_gke_hub_feature` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_feature.new` injects a new `google_gke_hub_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_feature` using the reference:\n\n    $._ref.google_gke_hub_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  fleet_default_member_config:: {
+    configmanagement:: {
+      config_sync:: {
+        git:: {
+          '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.git.new` constructs a new object with attributes and blocks configured for the `git`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gcp_service_account_email` (`string`): The Google Cloud Service Account Email used for auth when secretType is gcpServiceAccount When `null`, the `gcp_service_account_email` field will be omitted from the resulting object.\n  - `https_proxy` (`string`): URL for the HTTPS Proxy to be used when communicating with the Git repo When `null`, the `https_proxy` field will be omitted from the resulting object.\n  - `policy_dir` (`string`): The path within the Git repository that represents the top level of the repo to sync When `null`, the `policy_dir` field will be omitted from the resulting object.\n  - `secret_type` (`string`): Type of secret configured for access to the Git repo\n  - `sync_branch` (`string`): The branch of the repository to sync from. Default: master When `null`, the `sync_branch` field will be omitted from the resulting object.\n  - `sync_repo` (`string`): The URL of the Git repository to use as the source of truth When `null`, the `sync_repo` field will be omitted from the resulting object.\n  - `sync_rev` (`string`): Git revision (tag or hash) to check out. Default HEAD When `null`, the `sync_rev` field will be omitted from the resulting object.\n  - `sync_wait_secs` (`string`): Period in seconds between consecutive syncs. Default: 15 When `null`, the `sync_wait_secs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `git` sub block.\n', args=[]),
+          new(
+            secret_type,
+            gcp_service_account_email=null,
+            https_proxy=null,
+            policy_dir=null,
+            sync_branch=null,
+            sync_repo=null,
+            sync_rev=null,
+            sync_wait_secs=null
+          ):: std.prune(a={
+            gcp_service_account_email: gcp_service_account_email,
+            https_proxy: https_proxy,
+            policy_dir: policy_dir,
+            secret_type: secret_type,
+            sync_branch: sync_branch,
+            sync_repo: sync_repo,
+            sync_rev: sync_rev,
+            sync_wait_secs: sync_wait_secs,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.new` constructs a new object with attributes and blocks configured for the `config_sync`\nTerraform sub block.\n\n\n\n**Args**:\n  - `source_format` (`string`): Specifies whether the Config Sync Repo is in hierarchical or unstructured mode When `null`, the `source_format` field will be omitted from the resulting object.\n  - `git` (`list[obj]`): Git repo configuration for the cluster When `null`, the `git` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.git.new](#fn-fleet_default_member_configfleet_default_member_configconfigmanagementgitnew) constructor.\n  - `oci` (`list[obj]`): OCI repo configuration for the cluster When `null`, the `oci` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.oci.new](#fn-fleet_default_member_configfleet_default_member_configconfigmanagementocinew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config_sync` sub block.\n', args=[]),
+        new(
+          git=null,
+          oci=null,
+          source_format=null
+        ):: std.prune(a={
+          git: git,
+          oci: oci,
+          source_format: source_format,
+        }),
+        oci:: {
+          '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.oci.new` constructs a new object with attributes and blocks configured for the `oci`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gcp_service_account_email` (`string`): The Google Cloud Service Account Email used for auth when secretType is gcpServiceAccount When `null`, the `gcp_service_account_email` field will be omitted from the resulting object.\n  - `policy_dir` (`string`): The absolute path of the directory that contains the local resources. Default: the root directory of the image When `null`, the `policy_dir` field will be omitted from the resulting object.\n  - `secret_type` (`string`): Type of secret configured for access to the Git repo\n  - `sync_repo` (`string`): The OCI image repository URL for the package to sync from When `null`, the `sync_repo` field will be omitted from the resulting object.\n  - `sync_wait_secs` (`string`): Period in seconds between consecutive syncs. Default: 15 When `null`, the `sync_wait_secs` field will be omitted from the resulting object.\n  - `version` (`string`): Version of ACM installed When `null`, the `version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `oci` sub block.\n', args=[]),
+          new(
+            secret_type,
+            gcp_service_account_email=null,
+            policy_dir=null,
+            sync_repo=null,
+            sync_wait_secs=null,
+            version=null
+          ):: std.prune(a={
+            gcp_service_account_email: gcp_service_account_email,
+            policy_dir: policy_dir,
+            secret_type: secret_type,
+            sync_repo: sync_repo,
+            sync_wait_secs: sync_wait_secs,
+            version: version,
+          }),
+        },
+      },
+      '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.configmanagement.new` constructs a new object with attributes and blocks configured for the `configmanagement`\nTerraform sub block.\n\n\n\n**Args**:\n  - `version` (`string`): Version of ACM installed When `null`, the `version` field will be omitted from the resulting object.\n  - `config_sync` (`list[obj]`): ConfigSync configuration for the cluster When `null`, the `config_sync` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.new](#fn-fleet_default_member_configfleet_default_member_configconfig_syncnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `configmanagement` sub block.\n', args=[]),
+      new(
+        config_sync=null,
+        version=null
+      ):: std.prune(a={
+        config_sync: config_sync,
+        version: version,
+      }),
+    },
+    mesh:: {
+      '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.mesh.new` constructs a new object with attributes and blocks configured for the `mesh`\nTerraform sub block.\n\n\n\n**Args**:\n  - `management` (`string`): Whether to automatically manage Service Mesh Possible values: ["MANAGEMENT_UNSPECIFIED", "MANAGEMENT_AUTOMATIC", "MANAGEMENT_MANUAL"]\n\n**Returns**:\n  - An attribute object that represents the `mesh` sub block.\n', args=[]),
+      new(
+        management
+      ):: std.prune(a={
+        management: management,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.new` constructs a new object with attributes and blocks configured for the `fleet_default_member_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `configmanagement` (`list[obj]`): Config Management spec When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.new](#fn-fleet_default_member_configconfigmanagementnew) constructor.\n  - `mesh` (`list[obj]`): Service Mesh spec When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.mesh.new](#fn-fleet_default_member_configmeshnew) constructor.\n  - `policycontroller` (`list[obj]`): Policy Controller spec When `null`, the `policycontroller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.new](#fn-fleet_default_member_configpolicycontrollernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `fleet_default_member_config` sub block.\n', args=[]),
+    new(
+      configmanagement=null,
+      mesh=null,
+      policycontroller=null
+    ):: std.prune(a={
+      configmanagement: configmanagement,
+      mesh: mesh,
+      policycontroller: policycontroller,
+    }),
+    policycontroller:: {
+      '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.new` constructs a new object with attributes and blocks configured for the `policycontroller`\nTerraform sub block.\n\n\n\n**Args**:\n  - `version` (`string`): Configures the version of Policy Controller When `null`, the `version` field will be omitted from the resulting object.\n  - `policy_controller_hub_config` (`list[obj]`): Configuration of Policy Controller When `null`, the `policy_controller_hub_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.new](#fn-fleet_default_member_configfleet_default_member_configpolicy_controller_hub_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policycontroller` sub block.\n', args=[]),
+      new(
+        policy_controller_hub_config=null,
+        version=null
+      ):: std.prune(a={
+        policy_controller_hub_config: policy_controller_hub_config,
+        version: version,
+      }),
+      policy_controller_hub_config:: {
+        deployment_configs:: {
+          container_resources:: {
+            limits:: {
+              '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits.new` constructs a new object with attributes and blocks configured for the `limits`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu` (`string`): CPU requirement expressed in Kubernetes resource units. When `null`, the `cpu` field will be omitted from the resulting object.\n  - `memory` (`string`): Memory requirement expressed in Kubernetes resource units. When `null`, the `memory` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `limits` sub block.\n', args=[]),
+              new(
+                cpu=null,
+                memory=null
+              ):: std.prune(a={
+                cpu: cpu,
+                memory: memory,
+              }),
+            },
+            '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.new` constructs a new object with attributes and blocks configured for the `container_resources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `limits` (`list[obj]`): Limits describes the maximum amount of compute resources allowed for use by the running container. When `null`, the `limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configslimitsnew) constructor.\n  - `requests` (`list[obj]`): Requests describes the amount of compute resources reserved for the container by the kube-scheduler. When `null`, the `requests` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configsrequestsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `container_resources` sub block.\n', args=[]),
+            new(
+              limits=null,
+              requests=null
+            ):: std.prune(a={
+              limits: limits,
+              requests: requests,
+            }),
+            requests:: {
+              '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests.new` constructs a new object with attributes and blocks configured for the `requests`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu` (`string`): CPU requirement expressed in Kubernetes resource units. When `null`, the `cpu` field will be omitted from the resulting object.\n  - `memory` (`string`): Memory requirement expressed in Kubernetes resource units. When `null`, the `memory` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `requests` sub block.\n', args=[]),
+              new(
+                cpu=null,
+                memory=null
+              ):: std.prune(a={
+                cpu: cpu,
+                memory: memory,
+              }),
+            },
+          },
+          '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.new` constructs a new object with attributes and blocks configured for the `deployment_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `component` (`string`): Set the `component` field on the resulting object.\n  - `pod_affinity` (`string`): Pod affinity configuration. Possible values: ["AFFINITY_UNSPECIFIED", "NO_AFFINITY", "ANTI_AFFINITY"] When `null`, the `pod_affinity` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Pod replica count. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `container_resources` (`list[obj]`): Container resource requirements. When `null`, the `container_resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configcontainer_resourcesnew) constructor.\n  - `pod_toleration` (`list[obj]`): Pod tolerations of node taints. When `null`, the `pod_toleration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configpod_tolerationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `deployment_configs` sub block.\n', args=[]),
+          new(
+            component,
+            container_resources=null,
+            pod_affinity=null,
+            pod_toleration=null,
+            replica_count=null
+          ):: std.prune(a={
+            component: component,
+            container_resources: container_resources,
+            pod_affinity: pod_affinity,
+            pod_toleration: pod_toleration,
+            replica_count: replica_count,
+          }),
+          pod_toleration:: {
+            '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration.new` constructs a new object with attributes and blocks configured for the `pod_toleration`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Matches a taint effect. When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Matches a taint key (not necessarily unique). When `null`, the `key` field will be omitted from the resulting object.\n  - `operator` (`string`): Matches a taint operator. When `null`, the `operator` field will be omitted from the resulting object.\n  - `value` (`string`): Matches a taint value. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `pod_toleration` sub block.\n', args=[]),
+            new(
+              effect=null,
+              key=null,
+              operator=null,
+              value=null
+            ):: std.prune(a={
+              effect: effect,
+              key: key,
+              operator: operator,
+              value: value,
+            }),
+          },
+        },
+        monitoring:: {
+          '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring.new` constructs a new object with attributes and blocks configured for the `monitoring`\nTerraform sub block.\n\n\n\n**Args**:\n  - `backends` (`list`): Specifies the list of backends Policy Controller will export to. An empty list would effectively disable metrics export. Possible values: ["MONITORING_BACKEND_UNSPECIFIED", "PROMETHEUS", "CLOUD_MONITORING"] When `null`, the `backends` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `monitoring` sub block.\n', args=[]),
+          new(
+            backends=null
+          ):: std.prune(a={
+            backends: backends,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.new` constructs a new object with attributes and blocks configured for the `policy_controller_hub_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audit_interval_seconds` (`number`): Interval for Policy Controller Audit scans (in seconds). When set to 0, this disables audit functionality altogether. When `null`, the `audit_interval_seconds` field will be omitted from the resulting object.\n  - `constraint_violation_limit` (`number`): The maximum number of audit violations to be stored in a constraint. If not set, the internal default of 20 will be used. When `null`, the `constraint_violation_limit` field will be omitted from the resulting object.\n  - `exemptable_namespaces` (`list`): The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. When `null`, the `exemptable_namespaces` field will be omitted from the resulting object.\n  - `install_spec` (`string`): Configures the mode of the Policy Controller installation Possible values: ["INSTALL_SPEC_UNSPECIFIED", "INSTALL_SPEC_NOT_INSTALLED", "INSTALL_SPEC_ENABLED", "INSTALL_SPEC_SUSPENDED", "INSTALL_SPEC_DETACHED"]\n  - `log_denies_enabled` (`bool`): Logs all denies and dry run failures. When `null`, the `log_denies_enabled` field will be omitted from the resulting object.\n  - `mutation_enabled` (`bool`): Enables the ability to mutate resources using Policy Controller. When `null`, the `mutation_enabled` field will be omitted from the resulting object.\n  - `referential_rules_enabled` (`bool`): Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. When `null`, the `referential_rules_enabled` field will be omitted from the resulting object.\n  - `deployment_configs` (`list[obj]`): Map of deployment configs to deployments ("admission", "audit", "mutation"). When `null`, the `deployment_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerdeployment_configsnew) constructor.\n  - `monitoring` (`list[obj]`): Monitoring specifies the configuration of monitoring Policy Controller. When `null`, the `monitoring` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollermonitoringnew) constructor.\n  - `policy_content` (`list[obj]`): Specifies the desired policy content on the cluster. When `null`, the `policy_content` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_contentnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_controller_hub_config` sub block.\n', args=[]),
+        new(
+          install_spec,
+          audit_interval_seconds=null,
+          constraint_violation_limit=null,
+          deployment_configs=null,
+          exemptable_namespaces=null,
+          log_denies_enabled=null,
+          monitoring=null,
+          mutation_enabled=null,
+          policy_content=null,
+          referential_rules_enabled=null
+        ):: std.prune(a={
+          audit_interval_seconds: audit_interval_seconds,
+          constraint_violation_limit: constraint_violation_limit,
+          deployment_configs: deployment_configs,
+          exemptable_namespaces: exemptable_namespaces,
+          install_spec: install_spec,
+          log_denies_enabled: log_denies_enabled,
+          monitoring: monitoring,
+          mutation_enabled: mutation_enabled,
+          policy_content: policy_content,
+          referential_rules_enabled: referential_rules_enabled,
+        }),
+        policy_content:: {
+          bundles:: {
+            '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles.new` constructs a new object with attributes and blocks configured for the `bundles`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bundle` (`string`): Set the `bundle` field on the resulting object.\n  - `exempted_namespaces` (`list`): The set of namespaces to be exempted from the bundle. When `null`, the `exempted_namespaces` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `bundles` sub block.\n', args=[]),
+            new(
+              bundle,
+              exempted_namespaces=null
+            ):: std.prune(a={
+              bundle: bundle,
+              exempted_namespaces: exempted_namespaces,
+            }),
+          },
+          '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.new` constructs a new object with attributes and blocks configured for the `policy_content`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bundles` (`list[obj]`): Configures which bundles to install and their corresponding install specs. When `null`, the `bundles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configbundlesnew) constructor.\n  - `template_library` (`list[obj]`): Configures the installation of the Template Library. When `null`, the `template_library` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configtemplate_librarynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_content` sub block.\n', args=[]),
+          new(
+            bundles=null,
+            template_library=null
+          ):: std.prune(a={
+            bundles: bundles,
+            template_library: template_library,
+          }),
+          template_library:: {
+            '#new':: d.fn(help='\n`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library.new` constructs a new object with attributes and blocks configured for the `template_library`\nTerraform sub block.\n\n\n\n**Args**:\n  - `installation` (`string`): Configures the manner in which the template library is installed on the cluster. Possible values: ["INSTALATION_UNSPECIFIED", "NOT_INSTALLED", "ALL"] When `null`, the `installation` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `template_library` sub block.\n', args=[]),
+            new(
+              installation=null
+            ):: std.prune(a={
+              installation: installation,
+            }),
+          },
+        },
+      },
+    },
+  },
+  '#new':: d.fn(help="\n`google.gke_hub_feature.new` injects a new `google_gke_hub_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_feature` using the reference:\n\n    $._ref.google_gke_hub_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): GCP labels for this Feature.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `fleet_default_member_config` (`list[obj]`): Optional. Fleet Default Membership Configuration. When `null`, the `fleet_default_member_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.new](#fn-fleet_default_member_confignew) constructor.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
+    fleet_default_member_config=null,
     labels=null,
     name=null,
     project=null,
@@ -16,6 +231,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_gke_hub_feature',
     label=resourceLabel,
     attrs=self.newAttrs(
+      fleet_default_member_config=fleet_default_member_config,
       labels=labels,
       location=location,
       name=name,
@@ -25,15 +241,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_feature.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_feature`\nTerraform resource.\n\nUnlike [google.gke_hub_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_feature.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_feature`\nTerraform resource.\n\nUnlike [google.gke_hub_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): GCP labels for this Feature.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `fleet_default_member_config` (`list[obj]`): Optional. Fleet Default Membership Configuration. When `null`, the `fleet_default_member_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.new](#fn-fleet_default_member_confignew) constructor.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
+    fleet_default_member_config=null,
     labels=null,
     name=null,
     project=null,
     spec=null,
     timeouts=null
   ):: std.prune(a={
+    fleet_default_member_config: fleet_default_member_config,
     labels: labels,
     location: location,
     name: name,
@@ -42,6 +260,54 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   spec:: {
+    clusterupgrade:: {
+      gke_upgrade_overrides:: {
+        '#new':: d.fn(help='\n`google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.new` constructs a new object with attributes and blocks configured for the `gke_upgrade_overrides`\nTerraform sub block.\n\n\n\n**Args**:\n  - `post_conditions` (`list[obj]`): Post conditions to override for the specified upgrade. When `null`, the `post_conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.post_conditions.new](#fn-specspecclusterupgradepost_conditionsnew) constructor.\n  - `upgrade` (`list[obj]`): Which upgrade to override. When `null`, the `upgrade` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.upgrade.new](#fn-specspecclusterupgradeupgradenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `gke_upgrade_overrides` sub block.\n', args=[]),
+        new(
+          post_conditions=null,
+          upgrade=null
+        ):: std.prune(a={
+          post_conditions: post_conditions,
+          upgrade: upgrade,
+        }),
+        post_conditions:: {
+          '#new':: d.fn(help='\n`google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.post_conditions.new` constructs a new object with attributes and blocks configured for the `post_conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `soaking` (`string`): Amount of time to "soak" after a rollout has been finished before marking it COMPLETE. Cannot exceed 30 days.\n\n**Returns**:\n  - An attribute object that represents the `post_conditions` sub block.\n', args=[]),
+          new(
+            soaking
+          ):: std.prune(a={
+            soaking: soaking,
+          }),
+        },
+        upgrade:: {
+          '#new':: d.fn(help='\n`google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.upgrade.new` constructs a new object with attributes and blocks configured for the `upgrade`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the upgrade, e.g., "k8s_control_plane". It should be a valid upgrade name. It must not exceet 99 characters.\n  - `version` (`string`): Version of the upgrade, e.g., "1.22.1-gke.100". It should be a valid version. It must not exceet 99 characters.\n\n**Returns**:\n  - An attribute object that represents the `upgrade` sub block.\n', args=[]),
+          new(
+            name,
+            version
+          ):: std.prune(a={
+            name: name,
+            version: version,
+          }),
+        },
+      },
+      '#new':: d.fn(help='\n`google.gke_hub_feature.spec.clusterupgrade.new` constructs a new object with attributes and blocks configured for the `clusterupgrade`\nTerraform sub block.\n\n\n\n**Args**:\n  - `upstream_fleets` (`list`): Specified if other fleet should be considered as a source of upgrades. Currently, at most one upstream fleet is allowed. The fleet name should be either fleet project number or id.\n  - `gke_upgrade_overrides` (`list[obj]`): Configuration overrides for individual upgrades. When `null`, the `gke_upgrade_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.new](#fn-specspecgke_upgrade_overridesnew) constructor.\n  - `post_conditions` (`list[obj]`): Post conditions to override for the specified upgrade. When `null`, the `post_conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.post_conditions.new](#fn-specspecpost_conditionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `clusterupgrade` sub block.\n', args=[]),
+      new(
+        upstream_fleets,
+        gke_upgrade_overrides=null,
+        post_conditions=null
+      ):: std.prune(a={
+        gke_upgrade_overrides: gke_upgrade_overrides,
+        post_conditions: post_conditions,
+        upstream_fleets: upstream_fleets,
+      }),
+      post_conditions:: {
+        '#new':: d.fn(help='\n`google.gke_hub_feature.spec.clusterupgrade.post_conditions.new` constructs a new object with attributes and blocks configured for the `post_conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `soaking` (`string`): Amount of time to "soak" after a rollout has been finished before marking it COMPLETE. Cannot exceed 30 days.\n\n**Returns**:\n  - An attribute object that represents the `post_conditions` sub block.\n', args=[]),
+        new(
+          soaking
+        ):: std.prune(a={
+          soaking: soaking,
+        }),
+      },
+    },
     fleetobservability:: {
       logging_config:: {
         default_config:: {
@@ -84,11 +350,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         config_membership: config_membership,
       }),
     },
-    '#new':: d.fn(help='\n`google.gke_hub_feature.spec.new` constructs a new object with attributes and blocks configured for the `spec`\nTerraform sub block.\n\n\n\n**Args**:\n  - `fleetobservability` (`list[obj]`): Fleet Observability feature spec. When `null`, the `fleetobservability` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.fleetobservability.new](#fn-specfleetobservabilitynew) constructor.\n  - `multiclusteringress` (`list[obj]`): Multicluster Ingress-specific spec. When `null`, the `multiclusteringress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.multiclusteringress.new](#fn-specmulticlusteringressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `spec` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.gke_hub_feature.spec.new` constructs a new object with attributes and blocks configured for the `spec`\nTerraform sub block.\n\n\n\n**Args**:\n  - `clusterupgrade` (`list[obj]`): Clusterupgrade feature spec. When `null`, the `clusterupgrade` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.new](#fn-specclusterupgradenew) constructor.\n  - `fleetobservability` (`list[obj]`): Fleet Observability feature spec. When `null`, the `fleetobservability` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.fleetobservability.new](#fn-specfleetobservabilitynew) constructor.\n  - `multiclusteringress` (`list[obj]`): Multicluster Ingress-specific spec. When `null`, the `multiclusteringress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.multiclusteringress.new](#fn-specmulticlusteringressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `spec` sub block.\n', args=[]),
     new(
+      clusterupgrade=null,
       fleetobservability=null,
       multiclusteringress=null
     ):: std.prune(a={
+      clusterupgrade: clusterupgrade,
       fleetobservability: fleetobservability,
       multiclusteringress: multiclusteringress,
     }),
@@ -105,6 +373,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withFleetDefaultMemberConfig':: d.fn(help='`google.list[obj].withFleetDefaultMemberConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet_default_member_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFleetDefaultMemberConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet_default_member_config` field.\n', args=[]),
+  withFleetDefaultMemberConfig(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_feature+: {
+        [resourceLabel]+: {
+          fleet_default_member_config: value,
+        },
+      },
+    },
+  },
+  '#withFleetDefaultMemberConfigMixin':: d.fn(help='`google.list[obj].withFleetDefaultMemberConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet_default_member_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFleetDefaultMemberConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet_default_member_config` field.\n', args=[]),
+  withFleetDefaultMemberConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_feature+: {
+        [resourceLabel]+: {
+          fleet_default_member_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
   withLabels(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_feature_membership.libsonnet b/4.x/_gen/resources/gke_hub_feature_membership.libsonnet
index f147f40a..592f7c62 100644
--- a/4.x/_gen/resources/gke_hub_feature_membership.libsonnet
+++ b/4.x/_gen/resources/gke_hub_feature_membership.libsonnet
@@ -34,14 +34,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           sync_wait_secs: sync_wait_secs,
         }),
       },
-      '#new':: d.fn(help='\n`google.gke_hub_feature_membership.configmanagement.config_sync.new` constructs a new object with attributes and blocks configured for the `config_sync`\nTerraform sub block.\n\n\n\n**Args**:\n  - `prevent_drift` (`bool`): Set to true to enable the Config Sync admission webhook to prevent drifts. If set to `false`, disables the Config Sync admission webhook and does not prevent drifts. When `null`, the `prevent_drift` field will be omitted from the resulting object.\n  - `source_format` (`string`): Specifies whether the Config Sync Repo is in "hierarchical" or "unstructured" mode. When `null`, the `source_format` field will be omitted from the resulting object.\n  - `git` (`list[obj]`): Set the `git` field on the resulting object. When `null`, the `git` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.git.new](#fn-configmanagementconfigmanagementgitnew) constructor.\n  - `oci` (`list[obj]`): Set the `oci` field on the resulting object. When `null`, the `oci` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.oci.new](#fn-configmanagementconfigmanagementocinew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config_sync` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.gke_hub_feature_membership.configmanagement.config_sync.new` constructs a new object with attributes and blocks configured for the `config_sync`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metrics_gcp_service_account_email` (`string`): The Email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring. The GSA should have the Monitoring Metric Writer(roles/monitoring.metricWriter) IAM role. The Kubernetes ServiceAccount `default` in the namespace `config-management-monitoring` should be bound to the GSA. When `null`, the `metrics_gcp_service_account_email` field will be omitted from the resulting object.\n  - `prevent_drift` (`bool`): Set to true to enable the Config Sync admission webhook to prevent drifts. If set to `false`, disables the Config Sync admission webhook and does not prevent drifts. When `null`, the `prevent_drift` field will be omitted from the resulting object.\n  - `source_format` (`string`): Specifies whether the Config Sync Repo is in "hierarchical" or "unstructured" mode. When `null`, the `source_format` field will be omitted from the resulting object.\n  - `git` (`list[obj]`): Set the `git` field on the resulting object. When `null`, the `git` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.git.new](#fn-configmanagementconfigmanagementgitnew) constructor.\n  - `oci` (`list[obj]`): Set the `oci` field on the resulting object. When `null`, the `oci` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.oci.new](#fn-configmanagementconfigmanagementocinew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config_sync` sub block.\n', args=[]),
       new(
         git=null,
+        metrics_gcp_service_account_email=null,
         oci=null,
         prevent_drift=null,
         source_format=null
       ):: std.prune(a={
         git: git,
+        metrics_gcp_service_account_email: metrics_gcp_service_account_email,
         oci: oci,
         prevent_drift: prevent_drift,
         source_format: source_format,
@@ -75,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         enabled: enabled,
       }),
     },
-    '#new':: d.fn(help='\n`google.gke_hub_feature_membership.configmanagement.new` constructs a new object with attributes and blocks configured for the `configmanagement`\nTerraform sub block.\n\n\n\n**Args**:\n  - `version` (`string`): Optional. Version of ACM to install. Defaults to the latest version. When `null`, the `version` field will be omitted from the resulting object.\n  - `binauthz` (`list[obj]`): Binauthz configuration for the cluster. When `null`, the `binauthz` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.binauthz.new](#fn-configmanagementbinauthznew) constructor.\n  - `config_sync` (`list[obj]`): Config Sync configuration for the cluster. When `null`, the `config_sync` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.new](#fn-configmanagementconfig_syncnew) constructor.\n  - `hierarchy_controller` (`list[obj]`): Hierarchy Controller configuration for the cluster. When `null`, the `hierarchy_controller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.hierarchy_controller.new](#fn-configmanagementhierarchy_controllernew) constructor.\n  - `policy_controller` (`list[obj]`): Policy Controller configuration for the cluster. When `null`, the `policy_controller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.policy_controller.new](#fn-configmanagementpolicy_controllernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `configmanagement` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.gke_hub_feature_membership.configmanagement.new` constructs a new object with attributes and blocks configured for the `configmanagement`\nTerraform sub block.\n\n\n\n**Args**:\n  - `version` (`string`): Optional. Version of ACM to install. Defaults to the latest version. When `null`, the `version` field will be omitted from the resulting object.\n  - `binauthz` (`list[obj]`): **DEPRECATED** Binauthz configuration for the cluster. This field will be ignored and should not be set. When `null`, the `binauthz` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.binauthz.new](#fn-configmanagementbinauthznew) constructor.\n  - `config_sync` (`list[obj]`): Config Sync configuration for the cluster. When `null`, the `config_sync` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.new](#fn-configmanagementconfig_syncnew) constructor.\n  - `hierarchy_controller` (`list[obj]`): Hierarchy Controller configuration for the cluster. When `null`, the `hierarchy_controller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.hierarchy_controller.new](#fn-configmanagementhierarchy_controllernew) constructor.\n  - `policy_controller` (`list[obj]`): Policy Controller configuration for the cluster. When `null`, the `policy_controller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.policy_controller.new](#fn-configmanagementpolicy_controllernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `configmanagement` sub block.\n', args=[]),
     new(
       binauthz=null,
       config_sync=null,
@@ -130,14 +132,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       management: management,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_feature_membership.new` injects a new `google_gke_hub_feature_membership` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_feature_membership.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_feature_membership` using the reference:\n\n    $._ref.google_gke_hub_feature_membership.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_feature_membership.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `feature` (`string`): The name of the feature\n  - `location` (`string`): The location of the feature\n  - `membership` (`string`): The name of the membership\n  - `project` (`string`): The project of the feature When `null`, the `project` field will be omitted from the resulting object.\n  - `configmanagement` (`list[obj]`): Config Management-specific spec. When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.new](#fn-configmanagementnew) constructor.\n  - `mesh` (`list[obj]`): Manage Mesh Features When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.mesh.new](#fn-meshnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_feature_membership.new` injects a new `google_gke_hub_feature_membership` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_feature_membership.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_feature_membership` using the reference:\n\n    $._ref.google_gke_hub_feature_membership.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_feature_membership.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `feature` (`string`): The name of the feature\n  - `location` (`string`): The location of the feature\n  - `membership` (`string`): The name of the membership\n  - `membership_location` (`string`): The location of the membership When `null`, the `membership_location` field will be omitted from the resulting object.\n  - `project` (`string`): The project of the feature When `null`, the `project` field will be omitted from the resulting object.\n  - `configmanagement` (`list[obj]`): Config Management-specific spec. When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.new](#fn-configmanagementnew) constructor.\n  - `mesh` (`list[obj]`): Manage Mesh Features When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.mesh.new](#fn-meshnew) constructor.\n  - `policycontroller` (`list[obj]`): Policy Controller-specific spec. When `null`, the `policycontroller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.new](#fn-policycontrollernew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     feature,
     location,
     membership,
     configmanagement=null,
+    membership_location=null,
     mesh=null,
+    policycontroller=null,
     project=null,
     timeouts=null,
     _meta={}
@@ -149,19 +153,23 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       feature=feature,
       location=location,
       membership=membership,
+      membership_location=membership_location,
       mesh=mesh,
+      policycontroller=policycontroller,
       project=project,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_feature_membership.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_feature_membership`\nTerraform resource.\n\nUnlike [google.gke_hub_feature_membership.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `feature` (`string`): The name of the feature\n  - `location` (`string`): The location of the feature\n  - `membership` (`string`): The name of the membership\n  - `project` (`string`): The project of the feature When `null`, the `project` field will be omitted from the resulting object.\n  - `configmanagement` (`list[obj]`): Config Management-specific spec. When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.new](#fn-configmanagementnew) constructor.\n  - `mesh` (`list[obj]`): Manage Mesh Features When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.mesh.new](#fn-meshnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature_membership` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_feature_membership.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_feature_membership`\nTerraform resource.\n\nUnlike [google.gke_hub_feature_membership.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `feature` (`string`): The name of the feature\n  - `location` (`string`): The location of the feature\n  - `membership` (`string`): The name of the membership\n  - `membership_location` (`string`): The location of the membership When `null`, the `membership_location` field will be omitted from the resulting object.\n  - `project` (`string`): The project of the feature When `null`, the `project` field will be omitted from the resulting object.\n  - `configmanagement` (`list[obj]`): Config Management-specific spec. When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.new](#fn-configmanagementnew) constructor.\n  - `mesh` (`list[obj]`): Manage Mesh Features When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.mesh.new](#fn-meshnew) constructor.\n  - `policycontroller` (`list[obj]`): Policy Controller-specific spec. When `null`, the `policycontroller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.new](#fn-policycontrollernew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature_membership` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     feature,
     location,
     membership,
     configmanagement=null,
+    membership_location=null,
     mesh=null,
+    policycontroller=null,
     project=null,
     timeouts=null
   ):: std.prune(a={
@@ -169,10 +177,70 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     feature: feature,
     location: location,
     membership: membership,
+    membership_location: membership_location,
     mesh: mesh,
+    policycontroller: policycontroller,
     project: project,
     timeouts: timeouts,
   }),
+  policycontroller:: {
+    '#new':: d.fn(help='\n`google.gke_hub_feature_membership.policycontroller.new` constructs a new object with attributes and blocks configured for the `policycontroller`\nTerraform sub block.\n\n\n\n**Args**:\n  - `version` (`string`): Optional. Version of Policy Controller to install. Defaults to the latest version. When `null`, the `version` field will be omitted from the resulting object.\n  - `policy_controller_hub_config` (`list[obj]`): Policy Controller configuration for the cluster. When `null`, the `policy_controller_hub_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.new](#fn-policycontrollerpolicy_controller_hub_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policycontroller` sub block.\n', args=[]),
+    new(
+      policy_controller_hub_config=null,
+      version=null
+    ):: std.prune(a={
+      policy_controller_hub_config: policy_controller_hub_config,
+      version: version,
+    }),
+    policy_controller_hub_config:: {
+      monitoring:: {
+        '#new':: d.fn(help='\n`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.monitoring.new` constructs a new object with attributes and blocks configured for the `monitoring`\nTerraform sub block.\n\n\n\n**Args**:\n  - `backends` (`list`):  Specifies the list of backends Policy Controller will export to. Specifying an empty value `[]` disables metrics export. When `null`, the `backends` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `monitoring` sub block.\n', args=[]),
+        new(
+          backends=null
+        ):: std.prune(a={
+          backends: backends,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.new` constructs a new object with attributes and blocks configured for the `policy_controller_hub_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audit_interval_seconds` (`number`): Sets the interval for Policy Controller Audit Scans (in seconds). When set to 0, this disables audit functionality altogether. When `null`, the `audit_interval_seconds` field will be omitted from the resulting object.\n  - `constraint_violation_limit` (`number`): The maximum number of audit violations to be stored in a constraint. If not set, the internal default of 20 will be used. When `null`, the `constraint_violation_limit` field will be omitted from the resulting object.\n  - `exemptable_namespaces` (`list`): The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. When `null`, the `exemptable_namespaces` field will be omitted from the resulting object.\n  - `install_spec` (`string`): Configures the mode of the Policy Controller installation. Possible values: INSTALL_SPEC_UNSPECIFIED, INSTALL_SPEC_NOT_INSTALLED, INSTALL_SPEC_ENABLED, INSTALL_SPEC_SUSPENDED, INSTALL_SPEC_DETACHED When `null`, the `install_spec` field will be omitted from the resulting object.\n  - `log_denies_enabled` (`bool`): Logs all denies and dry run failures. When `null`, the `log_denies_enabled` field will be omitted from the resulting object.\n  - `mutation_enabled` (`bool`): Enables the ability to mutate resources using Policy Controller. When `null`, the `mutation_enabled` field will be omitted from the resulting object.\n  - `referential_rules_enabled` (`bool`): Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. When `null`, the `referential_rules_enabled` field will be omitted from the resulting object.\n  - `monitoring` (`list[obj]`): Specifies the backends Policy Controller should export metrics to. For example, to specify metrics should be exported to Cloud Monitoring and Prometheus, specify backends: ["cloudmonitoring", "prometheus"]. Default: ["cloudmonitoring", "prometheus"] When `null`, the `monitoring` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.monitoring.new](#fn-policycontrollerpolicycontrollermonitoringnew) constructor.\n  - `policy_content` (`list[obj]`): Specifies the desired policy content on the cluster. When `null`, the `policy_content` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.new](#fn-policycontrollerpolicycontrollerpolicy_contentnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_controller_hub_config` sub block.\n', args=[]),
+      new(
+        audit_interval_seconds=null,
+        constraint_violation_limit=null,
+        exemptable_namespaces=null,
+        install_spec=null,
+        log_denies_enabled=null,
+        monitoring=null,
+        mutation_enabled=null,
+        policy_content=null,
+        referential_rules_enabled=null
+      ):: std.prune(a={
+        audit_interval_seconds: audit_interval_seconds,
+        constraint_violation_limit: constraint_violation_limit,
+        exemptable_namespaces: exemptable_namespaces,
+        install_spec: install_spec,
+        log_denies_enabled: log_denies_enabled,
+        monitoring: monitoring,
+        mutation_enabled: mutation_enabled,
+        policy_content: policy_content,
+        referential_rules_enabled: referential_rules_enabled,
+      }),
+      policy_content:: {
+        '#new':: d.fn(help='\n`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.new` constructs a new object with attributes and blocks configured for the `policy_content`\nTerraform sub block.\n\n\n\n**Args**:\n  - `template_library` (`list[obj]`): Configures the installation of the Template Library. When `null`, the `template_library` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.template_library.new](#fn-policycontrollerpolicycontrollerpolicy_controller_hub_configtemplate_librarynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_content` sub block.\n', args=[]),
+        new(
+          template_library=null
+        ):: std.prune(a={
+          template_library: template_library,
+        }),
+        template_library:: {
+          '#new':: d.fn(help='\n`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.template_library.new` constructs a new object with attributes and blocks configured for the `template_library`\nTerraform sub block.\n\n\n\n**Args**:\n  - `installation` (`string`): Configures the manner in which the template library is installed on the cluster. Possible values: INSTALLATION_UNSPECIFIED, NOT_INSTALLED, ALL When `null`, the `installation` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `template_library` sub block.\n', args=[]),
+          new(
+            installation=null
+          ):: std.prune(a={
+            installation: installation,
+          }),
+        },
+      },
+    },
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.gke_hub_feature_membership.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -235,6 +303,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withMembershipLocation':: d.fn(help='`google.string.withMembershipLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the membership_location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_location` field.\n', args=[]),
+  withMembershipLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_feature_membership+: {
+        [resourceLabel]+: {
+          membership_location: value,
+        },
+      },
+    },
+  },
   '#withMesh':: d.fn(help='`google.list[obj].withMesh` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the mesh field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMeshMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `mesh` field.\n', args=[]),
   withMesh(resourceLabel, value): {
     resource+: {
@@ -255,6 +333,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPolicycontroller':: d.fn(help='`google.list[obj].withPolicycontroller` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the policycontroller field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPolicycontrollerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `policycontroller` field.\n', args=[]),
+  withPolicycontroller(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_feature_membership+: {
+        [resourceLabel]+: {
+          policycontroller: value,
+        },
+      },
+    },
+  },
+  '#withPolicycontrollerMixin':: d.fn(help='`google.list[obj].withPolicycontrollerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the policycontroller field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPolicycontroller](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `policycontroller` field.\n', args=[]),
+  withPolicycontrollerMixin(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_feature_membership+: {
+        [resourceLabel]+: {
+          policycontroller+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
   withProject(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_fleet.libsonnet b/4.x/_gen/resources/gke_hub_fleet.libsonnet
new file mode 100644
index 00000000..31b63e40
--- /dev/null
+++ b/4.x/_gen/resources/gke_hub_fleet.libsonnet
@@ -0,0 +1,146 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gke_hub_fleet', url='', help='`gke_hub_fleet` represents the `google_gke_hub_fleet` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  default_cluster_config:: {
+    binary_authorization_config:: {
+      '#new':: d.fn(help='\n`google.gke_hub_fleet.default_cluster_config.binary_authorization_config.new` constructs a new object with attributes and blocks configured for the `binary_authorization_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `evaluation_mode` (`string`): Mode of operation for binauthz policy evaluation. Possible values: ["DISABLED", "POLICY_BINDINGS"] When `null`, the `evaluation_mode` field will be omitted from the resulting object.\n  - `policy_bindings` (`list[obj]`): Binauthz policies that apply to this cluster. When `null`, the `policy_bindings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.binary_authorization_config.policy_bindings.new](#fn-default_cluster_configdefault_cluster_configpolicy_bindingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `binary_authorization_config` sub block.\n', args=[]),
+      new(
+        evaluation_mode=null,
+        policy_bindings=null
+      ):: std.prune(a={
+        evaluation_mode: evaluation_mode,
+        policy_bindings: policy_bindings,
+      }),
+      policy_bindings:: {
+        '#new':: d.fn(help='\n`google.gke_hub_fleet.default_cluster_config.binary_authorization_config.policy_bindings.new` constructs a new object with attributes and blocks configured for the `policy_bindings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The relative resource name of the binauthz platform policy to audit. GKE\nplatform policies have the following format:\n'projects/{project_number}/platforms/gke/policies/{policy_id}'. When `null`, the `name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `policy_bindings` sub block.\n', args=[]),
+        new(
+          name=null
+        ):: std.prune(a={
+          name: name,
+        }),
+      },
+    },
+    '#new':: d.fn(help='\n`google.gke_hub_fleet.default_cluster_config.new` constructs a new object with attributes and blocks configured for the `default_cluster_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `binary_authorization_config` (`list[obj]`): Enable/Disable binary authorization features for the cluster. When `null`, the `binary_authorization_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.binary_authorization_config.new](#fn-default_cluster_configbinary_authorization_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Enable/Disable Security Posture features for the cluster. When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.security_posture_config.new](#fn-default_cluster_configsecurity_posture_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `default_cluster_config` sub block.\n', args=[]),
+    new(
+      binary_authorization_config=null,
+      security_posture_config=null
+    ):: std.prune(a={
+      binary_authorization_config: binary_authorization_config,
+      security_posture_config: security_posture_config,
+    }),
+    security_posture_config:: {
+      '#new':: d.fn(help='\n`google.gke_hub_fleet.default_cluster_config.security_posture_config.new` constructs a new object with attributes and blocks configured for the `security_posture_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Sets which mode to use for Security Posture features. Possible values: ["DISABLED", "BASIC"] When `null`, the `mode` field will be omitted from the resulting object.\n  - `vulnerability_mode` (`string`): Sets which mode to use for vulnerability scanning. Possible values: ["VULNERABILITY_DISABLED", "VULNERABILITY_BASIC", "VULNERABILITY_ENTERPRISE"] When `null`, the `vulnerability_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `security_posture_config` sub block.\n', args=[]),
+      new(
+        mode=null,
+        vulnerability_mode=null
+      ):: std.prune(a={
+        mode: mode,
+        vulnerability_mode: vulnerability_mode,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.gke_hub_fleet.new` injects a new `google_gke_hub_fleet` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_fleet.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_fleet` using the reference:\n\n    $._ref.google_gke_hub_fleet.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_fleet.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.\nAllowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `default_cluster_config` (`list[obj]`): The default cluster configurations to apply across the fleet. When `null`, the `default_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.new](#fn-default_cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    default_cluster_config=null,
+    display_name=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gke_hub_fleet',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      default_cluster_config=default_cluster_config,
+      display_name=display_name,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_fleet.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_fleet`\nTerraform resource.\n\nUnlike [google.gke_hub_fleet.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.\nAllowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `default_cluster_config` (`list[obj]`): The default cluster configurations to apply across the fleet. When `null`, the `default_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.new](#fn-default_cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_fleet` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    default_cluster_config=null,
+    display_name=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    default_cluster_config: default_cluster_config,
+    display_name: display_name,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gke_hub_fleet.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDefaultClusterConfig':: d.fn(help='`google.list[obj].withDefaultClusterConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the default_cluster_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDefaultClusterConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `default_cluster_config` field.\n', args=[]),
+  withDefaultClusterConfig(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          default_cluster_config: value,
+        },
+      },
+    },
+  },
+  '#withDefaultClusterConfigMixin':: d.fn(help='`google.list[obj].withDefaultClusterConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the default_cluster_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDefaultClusterConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `default_cluster_config` field.\n', args=[]),
+  withDefaultClusterConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          default_cluster_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gke_hub_membership.libsonnet b/4.x/_gen/resources/gke_hub_membership.libsonnet
index f46d56a8..cfa14dc7 100644
--- a/4.x/_gen/resources/gke_hub_membership.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership.libsonnet
@@ -26,13 +26,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       gke_cluster: gke_cluster,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_membership.new` injects a new `google_gke_hub_membership` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership` using the reference:\n\n    $._ref.google_gke_hub_membership.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership.new` injects a new `google_gke_hub_membership` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership` using the reference:\n\n    $._ref.google_gke_hub_membership.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels to apply to this membership.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     membership_id,
     authority=null,
     endpoint=null,
     labels=null,
+    location=null,
     project=null,
     timeouts=null,
     _meta={}
@@ -43,24 +44,27 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       authority=authority,
       endpoint=endpoint,
       labels=labels,
+      location=location,
       membership_id=membership_id,
       project=project,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership`\nTerraform resource.\n\nUnlike [google.gke_hub_membership.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership`\nTerraform resource.\n\nUnlike [google.gke_hub_membership.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels to apply to this membership.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     membership_id,
     authority=null,
     endpoint=null,
     labels=null,
+    location=null,
     project=null,
     timeouts=null
   ):: std.prune(a={
     authority: authority,
     endpoint: endpoint,
     labels: labels,
+    location: location,
     membership_id: membership_id,
     project: project,
     timeouts: timeouts,
@@ -127,6 +131,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembershipId':: d.fn(help='`google.string.withMembershipId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the membership_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_id` field.\n', args=[]),
   withMembershipId(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_membership_binding.libsonnet b/4.x/_gen/resources/gke_hub_membership_binding.libsonnet
index 4fa7479d..142328bf 100644
--- a/4.x/_gen/resources/gke_hub_membership_binding.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_binding.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_membership_binding', url='', help='`gke_hub_membership_binding` represents the `google_gke_hub_membership_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_membership_binding.new` injects a new `google_gke_hub_membership_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n\u0026#39;projects/*/locations/*/scopes/*\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_binding.new` injects a new `google_gke_hub_membership_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Membership binding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n\u0026#39;projects/*/locations/*/scopes/*\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n'projects/*/locations/*/scopes/*'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Membership binding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n'projects/*/locations/*/scopes/*'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_binding` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     membership_binding_id,
diff --git a/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet b/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet
index d90880f3..ca9ebfa1 100644
--- a/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet
@@ -14,13 +14,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       title: title,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_binding.new` injects a new `google_gke_hub_membership_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_binding.new` injects a new `google_gke_hub_membership_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     members,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withResource(
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       condition=condition,
+      location=location,
       members=members,
       membership_id=membership_id,
       project=project,
@@ -35,15 +37,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_binding` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     members,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null
   ):: std.prune(a={
     condition: condition,
+    location: location,
     members: members,
     membership_id: membership_id,
     project: project,
@@ -69,6 +73,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership_iam_binding+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
   withMembers(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet b/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet
index 6f3a6aae..dcc80bb6 100644
--- a/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet
@@ -14,13 +14,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       title: title,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_member.new` injects a new `google_gke_hub_membership_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_member` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_member.new` injects a new `google_gke_hub_membership_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_member` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     member,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withResource(
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       condition=condition,
+      location=location,
       member=member,
       membership_id=membership_id,
       project=project,
@@ -35,15 +37,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_member`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_member`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_member` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     member,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null
   ):: std.prune(a={
     condition: condition,
+    location: location,
     member: member,
     membership_id: membership_id,
     project: project,
@@ -69,6 +73,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership_iam_member+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
   withMember(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet b/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet
index 91d4e4a2..583ab28d 100644
--- a/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet
@@ -2,29 +2,47 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_membership_iam_policy', url='', help='`gke_hub_membership_iam_policy` represents the `google_gke_hub_membership_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_policy.new` injects a new `google_gke_hub_membership_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_policy.new` injects a new `google_gke_hub_membership_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     membership_id,
     policy_data,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withResource(
     type='google_gke_hub_membership_iam_policy',
     label=resourceLabel,
-    attrs=self.newAttrs(membership_id=membership_id, policy_data=policy_data, project=project),
+    attrs=self.newAttrs(
+      location=location,
+      membership_id=membership_id,
+      policy_data=policy_data,
+      project=project
+    ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     membership_id,
     policy_data,
+    location=null,
     project=null
   ):: std.prune(a={
+    location: location,
     membership_id: membership_id,
     policy_data: policy_data,
     project: project,
   }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership_iam_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembershipId':: d.fn(help='`google.string.withMembershipId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the membership_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_id` field.\n', args=[]),
   withMembershipId(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_namespace.libsonnet b/4.x/_gen/resources/gke_hub_namespace.libsonnet
index 90b8958b..08312380 100644
--- a/4.x/_gen/resources/gke_hub_namespace.libsonnet
+++ b/4.x/_gen/resources/gke_hub_namespace.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_namespace', url='', help='`gke_hub_namespace` represents the `google_gke_hub_namespace` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_namespace.new` injects a new `google_gke_hub_namespace` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_namespace.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_namespace` using the reference:\n\n    $._ref.google_gke_hub_namespace.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_namespace.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels (\u0026#39;namespace_labels\u0026#39; in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_namespace.new` injects a new `google_gke_hub_namespace` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_namespace.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_namespace` using the reference:\n\n    $._ref.google_gke_hub_namespace.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_namespace.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Namespace.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels (\u0026#39;namespace_labels\u0026#39; in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     scope,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_namespace.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_namespace`\nTerraform resource.\n\nUnlike [google.gke_hub_namespace.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels ('namespace_labels' in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_namespace` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_namespace.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_namespace`\nTerraform resource.\n\nUnlike [google.gke_hub_namespace.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Namespace.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels ('namespace_labels' in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_namespace` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     scope,
     scope_id,
diff --git a/4.x/_gen/resources/gke_hub_scope.libsonnet b/4.x/_gen/resources/gke_hub_scope.libsonnet
index 493826c0..0ccbd3db 100644
--- a/4.x/_gen/resources/gke_hub_scope.libsonnet
+++ b/4.x/_gen/resources/gke_hub_scope.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_scope', url='', help='`gke_hub_scope` represents the `google_gke_hub_scope` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_scope.new` injects a new `google_gke_hub_scope` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope` using the reference:\n\n    $._ref.google_gke_hub_scope.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_scope.new` injects a new `google_gke_hub_scope` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope` using the reference:\n\n    $._ref.google_gke_hub_scope.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Scope.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     scope_id,
@@ -21,7 +21,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope`\nTerraform resource.\n\nUnlike [google.gke_hub_scope.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope`\nTerraform resource.\n\nUnlike [google.gke_hub_scope.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Scope.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     scope_id,
     labels=null,
diff --git a/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet b/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet
index b29adb17..4b7d2536 100644
--- a/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet
+++ b/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_scope_rbac_role_binding', url='', help='`gke_hub_scope_rbac_role_binding` represents the `google_gke_hub_scope_rbac_role_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_scope_rbac_role_binding.new` injects a new `google_gke_hub_scope_rbac_role_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope_rbac_role_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope_rbac_role_binding` using the reference:\n\n    $._ref.google_gke_hub_scope_rbac_role_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope_rbac_role_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n\u0026#34;alice\u0026#34; or \u0026#34;alice@domain.tld\u0026#34; When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_scope_rbac_role_binding.new` injects a new `google_gke_hub_scope_rbac_role_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope_rbac_role_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope_rbac_role_binding` using the reference:\n\n    $._ref.google_gke_hub_scope_rbac_role_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope_rbac_role_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n\u0026#34;alice\u0026#34; or \u0026#34;alice@domain.tld\u0026#34; When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     scope_id,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope_rbac_role_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope_rbac_role_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_scope_rbac_role_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n"alice" or "alice@domain.tld" When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope_rbac_role_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope_rbac_role_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope_rbac_role_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_scope_rbac_role_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n"alice" or "alice@domain.tld" When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope_rbac_role_binding` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     scope_id,
     scope_rbac_role_binding_id,
diff --git a/4.x/_gen/resources/gkeonprem_bare_metal_admin_cluster.libsonnet b/4.x/_gen/resources/gkeonprem_bare_metal_admin_cluster.libsonnet
new file mode 100644
index 00000000..80161359
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_bare_metal_admin_cluster.libsonnet
@@ -0,0 +1,604 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_bare_metal_admin_cluster', url='', help='`gkeonprem_bare_metal_admin_cluster` represents the `google_gkeonprem_bare_metal_admin_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  cluster_operations:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cluster_operations` sub block.\n', args=[]),
+    new(
+      enable_application_logs=null
+    ):: std.prune(a={
+      enable_application_logs: enable_application_logs,
+    }),
+  },
+  control_plane:: {
+    api_server_args:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`\nTerraform sub block.\n\n\n\n**Args**:\n  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.\n  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.\n\n**Returns**:\n  - An attribute object that represents the `api_server_args` sub block.\n', args=[]),
+      new(
+        argument,
+        value
+      ):: std.prune(a={
+        argument: argument,
+        value: value,
+      }),
+    },
+    control_plane_node_pool_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_node_pool_config` sub block.\n', args=[]),
+      new(
+        node_pool_config=null
+      ):: std.prune(a={
+        node_pool_config: node_pool_config,
+      }),
+      node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+        new(
+          labels=null,
+          node_configs=null,
+          operating_system=null,
+          taints=null
+        ):: std.prune(a={
+          labels: labels,
+          node_configs: node_configs,
+          operating_system: operating_system,
+          taints: taints,
+        }),
+        node_configs:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+          new(
+            labels=null,
+            node_ip=null
+          ):: std.prune(a={
+            labels: labels,
+            node_ip: node_ip,
+          }),
+        },
+        taints:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+          new(
+            effect=null,
+            key=null,
+            value=null
+          ):: std.prune(a={
+            effect: effect,
+            key: key,
+            value: value,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`\nTerraform sub block.\n\n\n\n**Args**:\n  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of\ncustomized flags are supported. Please refer to the API server\ndocumentation below to know the exact format:\nhttps://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.\n  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane` sub block.\n', args=[]),
+    new(
+      api_server_args=null,
+      control_plane_node_pool_config=null
+    ):: std.prune(a={
+      api_server_args: api_server_args,
+      control_plane_node_pool_config: control_plane_node_pool_config,
+    }),
+  },
+  load_balancer:: {
+    manual_lb_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether manual load balancing is enabled.\n\n**Returns**:\n  - An attribute object that represents the `manual_lb_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.\n  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.\n  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer` sub block.\n', args=[]),
+    new(
+      manual_lb_config=null,
+      port_config=null,
+      vip_config=null
+    ):: std.prune(a={
+      manual_lb_config: manual_lb_config,
+      port_config: port_config,
+      vip_config: vip_config,
+    }),
+    port_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.\n\n**Returns**:\n  - An attribute object that represents the `port_config` sub block.\n', args=[]),
+      new(
+        control_plane_load_balancer_port
+      ):: std.prune(a={
+        control_plane_load_balancer_port: control_plane_load_balancer_port,
+      }),
+    },
+    vip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal Admin Cluster.\n\n**Returns**:\n  - An attribute object that represents the `vip_config` sub block.\n', args=[]),
+      new(
+        control_plane_vip
+      ):: std.prune(a={
+        control_plane_vip: control_plane_vip,
+      }),
+    },
+  },
+  maintenance_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.\nNodes in maintenance mode will be cordoned and drained. When both of these\nare true, the "baremetal.cluster.gke.io/maintenance" annotation will be set\non the node resource.\n\n**Returns**:\n  - An attribute object that represents the `maintenance_config` sub block.\n', args=[]),
+    new(
+      maintenance_address_cidr_blocks
+    ):: std.prune(a={
+      maintenance_address_cidr_blocks: maintenance_address_cidr_blocks,
+    }),
+  },
+  network_config:: {
+    island_mode_cidr:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n\n**Returns**:\n  - An attribute object that represents the `island_mode_cidr` sub block.\n', args=[]),
+      new(
+        pod_address_cidr_blocks,
+        service_address_cidr_blocks
+      ):: std.prune(a={
+        pod_address_cidr_blocks: pod_address_cidr_blocks,
+        service_address_cidr_blocks: service_address_cidr_blocks,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      island_mode_cidr=null
+    ):: std.prune(a={
+      island_mode_cidr: island_mode_cidr,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_bare_metal_admin_cluster.new` injects a new `google_gkeonprem_bare_metal_admin_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_bare_metal_admin_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_admin_cluster` using the reference:\n\n    $._ref.google_gkeonprem_bare_metal_admin_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_bare_metal_admin_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal admin cluster name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster\u0026#39;s observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    annotations=null,
+    bare_metal_version=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_bare_metal_admin_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      annotations=annotations,
+      bare_metal_version=bare_metal_version,
+      cluster_operations=cluster_operations,
+      control_plane=control_plane,
+      description=description,
+      load_balancer=load_balancer,
+      location=location,
+      maintenance_config=maintenance_config,
+      name=name,
+      network_config=network_config,
+      node_access_config=node_access_config,
+      node_config=node_config,
+      project=project,
+      proxy=proxy,
+      security_config=security_config,
+      storage=storage,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_admin_cluster`\nTerraform resource.\n\nUnlike [google.gkeonprem_bare_metal_admin_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal admin cluster name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_admin_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    annotations=null,
+    bare_metal_version=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null
+  ):: std.prune(a={
+    annotations: annotations,
+    bare_metal_version: bare_metal_version,
+    cluster_operations: cluster_operations,
+    control_plane: control_plane,
+    description: description,
+    load_balancer: load_balancer,
+    location: location,
+    maintenance_config: maintenance_config,
+    name: name,
+    network_config: network_config,
+    node_access_config: node_access_config,
+    node_config: node_config,
+    project: project,
+    proxy: proxy,
+    security_config: security_config,
+    storage: storage,
+    timeouts: timeouts,
+  }),
+  node_access_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `login_user` (`string`): LoginUser is the user name used to access node machines.\nIt defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_access_config` sub block.\n', args=[]),
+    new(
+      login_user=null
+    ):: std.prune(a={
+      login_user: login_user,
+    }),
+  },
+  node_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range\nassigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      max_pods_per_node=null
+    ):: std.prune(a={
+      max_pods_per_node: max_pods_per_node,
+    }),
+  },
+  proxy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.\nExamples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.\n  - `uri` (`string`): Specifies the address of your proxy server.\nExamples: http://domain\nWARNING: Do not provide credentials in the format\nhttp://(username:password@)domain these will be rejected by the server.\n\n**Returns**:\n  - An attribute object that represents the `proxy` sub block.\n', args=[]),
+    new(
+      uri,
+      no_proxy=null
+    ):: std.prune(a={
+      no_proxy: no_proxy,
+      uri: uri,
+    }),
+  },
+  security_config:: {
+    authorization:: {
+      admin_users:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+        new(
+          username
+        ):: std.prune(a={
+          username: username,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+      new(
+        admin_users=null
+      ):: std.prune(a={
+        admin_users: admin_users,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `security_config` sub block.\n', args=[]),
+    new(
+      authorization=null
+    ):: std.prune(a={
+      authorization: authorization,
+    }),
+  },
+  storage:: {
+    lvp_node_mounts_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_node_mounts_config` sub block.\n', args=[]),
+      new(
+        path,
+        storage_class
+      ):: std.prune(a={
+        path: path,
+        storage_class: storage_class,
+      }),
+    },
+    lvp_share_config:: {
+      lvp_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_config` sub block.\n', args=[]),
+        new(
+          path,
+          storage_class
+        ):: std.prune(a={
+          path: path,
+          storage_class: storage_class,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.\n  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `lvp_share_config` sub block.\n', args=[]),
+      new(
+        lvp_config=null,
+        shared_path_pv_count=null
+      ):: std.prune(a={
+        lvp_config: lvp_config,
+        shared_path_pv_count: shared_path_pv_count,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`\nTerraform sub block.\n\n\n\n**Args**:\n  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed\nby mounted node disks. These disks need to be formatted and mounted by the\nuser, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.\n  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by\nsubdirectories in a shared filesystem. These subdirectores are\nautomatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `storage` sub block.\n', args=[]),
+    new(
+      lvp_node_mounts_config=null,
+      lvp_share_config=null
+    ):: std.prune(a={
+      lvp_node_mounts_config: lvp_node_mounts_config,
+      lvp_share_config: lvp_share_config,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withBareMetalVersion':: d.fn(help='`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the bare_metal_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `bare_metal_version` field.\n', args=[]),
+  withBareMetalVersion(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          bare_metal_version: value,
+        },
+      },
+    },
+  },
+  '#withClusterOperations':: d.fn(help='`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations: value,
+        },
+      },
+    },
+  },
+  '#withClusterOperationsMixin':: d.fn(help='`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperationsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlane(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          control_plane: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneMixin':: d.fn(help='`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlaneMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          control_plane+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancer':: d.fn(help='`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancer(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          load_balancer: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancerMixin':: d.fn(help='`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancerMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          load_balancer+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfig':: d.fn(help='`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfigMixin':: d.fn(help='`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfig':: d.fn(help='`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_access_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfigMixin':: d.fn(help='`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_access_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withProxy':: d.fn(help='`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          proxy: value,
+        },
+      },
+    },
+  },
+  '#withProxyMixin':: d.fn(help='`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          proxy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withSecurityConfig':: d.fn(help='`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          security_config: value,
+        },
+      },
+    },
+  },
+  '#withSecurityConfigMixin':: d.fn(help='`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          security_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStorage':: d.fn(help='`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorage(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          storage: value,
+        },
+      },
+    },
+  },
+  '#withStorageMixin':: d.fn(help='`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorageMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          storage+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_bare_metal_cluster.libsonnet b/4.x/_gen/resources/gkeonprem_bare_metal_cluster.libsonnet
new file mode 100644
index 00000000..b2a5316a
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_bare_metal_cluster.libsonnet
@@ -0,0 +1,910 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_bare_metal_cluster', url='', help='`gkeonprem_bare_metal_cluster` represents the `google_gkeonprem_bare_metal_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  binary_authorization:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `evaluation_mode` (`string`): Mode of operation for binauthz policy evaluation. If unspecified,\ndefaults to DISABLED. Possible values: ["DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"] When `null`, the `evaluation_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `binary_authorization` sub block.\n', args=[]),
+    new(
+      evaluation_mode=null
+    ):: std.prune(a={
+      evaluation_mode: evaluation_mode,
+    }),
+  },
+  cluster_operations:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cluster_operations` sub block.\n', args=[]),
+    new(
+      enable_application_logs=null
+    ):: std.prune(a={
+      enable_application_logs: enable_application_logs,
+    }),
+  },
+  control_plane:: {
+    api_server_args:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`\nTerraform sub block.\n\n\n\n**Args**:\n  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.\n  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.\n\n**Returns**:\n  - An attribute object that represents the `api_server_args` sub block.\n', args=[]),
+      new(
+        argument,
+        value
+      ):: std.prune(a={
+        argument: argument,
+        value: value,
+      }),
+    },
+    control_plane_node_pool_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_node_pool_config` sub block.\n', args=[]),
+      new(
+        node_pool_config=null
+      ):: std.prune(a={
+        node_pool_config: node_pool_config,
+      }),
+      node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+        new(
+          labels=null,
+          node_configs=null,
+          operating_system=null,
+          taints=null
+        ):: std.prune(a={
+          labels: labels,
+          node_configs: node_configs,
+          operating_system: operating_system,
+          taints: taints,
+        }),
+        node_configs:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+          new(
+            labels=null,
+            node_ip=null
+          ):: std.prune(a={
+            labels: labels,
+            node_ip: node_ip,
+          }),
+        },
+        taints:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+          new(
+            effect=null,
+            key=null,
+            value=null
+          ):: std.prune(a={
+            effect: effect,
+            key: key,
+            value: value,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`\nTerraform sub block.\n\n\n\n**Args**:\n  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of\ncustomized flags are supported. Please refer to the API server\ndocumentation below to know the exact format:\nhttps://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.\n  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane` sub block.\n', args=[]),
+    new(
+      api_server_args=null,
+      control_plane_node_pool_config=null
+    ):: std.prune(a={
+      api_server_args: api_server_args,
+      control_plane_node_pool_config: control_plane_node_pool_config,
+    }),
+  },
+  load_balancer:: {
+    bgp_lb_config:: {
+      address_pools:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`\nTerraform sub block.\n\n\n\n**Args**:\n  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).\n  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.\nThis avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.\n  - `manual_assign` (`string`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the address pool.\n\n**Returns**:\n  - An attribute object that represents the `address_pools` sub block.\n', args=[]),
+        new(
+          addresses,
+          pool,
+          avoid_buggy_ips=null,
+          manual_assign=null
+        ):: std.prune(a={
+          addresses: addresses,
+          avoid_buggy_ips: avoid_buggy_ips,
+          manual_assign: manual_assign,
+          pool: pool,
+        }),
+      },
+      bgp_peer_configs:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new` constructs a new object with attributes and blocks configured for the `bgp_peer_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `asn` (`number`): BGP autonomous system number (ASN) for the network that contains the\nexternal peer device.\n  - `control_plane_nodes` (`list`): The IP address of the control plane node that connects to the external\npeer.\nIf you don't specify any control plane nodes, all control plane nodes\ncan connect to the external peer. If you specify one or more IP addresses,\nonly the nodes specified participate in peering sessions. When `null`, the `control_plane_nodes` field will be omitted from the resulting object.\n  - `ip_address` (`string`): The IP address of the external peer device.\n\n**Returns**:\n  - An attribute object that represents the `bgp_peer_configs` sub block.\n', args=[]),
+        new(
+          asn,
+          ip_address,
+          control_plane_nodes=null
+        ):: std.prune(a={
+          asn: asn,
+          control_plane_nodes: control_plane_nodes,
+          ip_address: ip_address,
+        }),
+      },
+      load_balancer_node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancerbgp_lb_confignode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer_node_pool_config` sub block.\n', args=[]),
+        new(
+          node_pool_config=null
+        ):: std.prune(a={
+          node_pool_config: node_pool_config,
+        }),
+        node_pool_config:: {
+          kubelet_config:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new` constructs a new object with attributes and blocks configured for the `kubelet_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `registry_burst` (`number`): The maximum size of bursty pulls, temporarily allows pulls to burst to this\nnumber, while still not exceeding registry_pull_qps.\nThe value must not be a negative number.\nUpdating this field may impact scalability by changing the amount of\ntraffic produced by image pulls.\nDefaults to 10. When `null`, the `registry_burst` field will be omitted from the resulting object.\n  - `registry_pull_qps` (`number`): The limit of registry pulls per second.\nSetting this value to 0 means no limit.\nUpdating this field may impact scalability by changing the amount of\ntraffic produced by image pulls.\nDefaults to 5. When `null`, the `registry_pull_qps` field will be omitted from the resulting object.\n  - `serialize_image_pulls_disabled` (`bool`): Prevents the Kubelet from pulling multiple images at a time.\nWe recommend *not* changing the default value on nodes that run docker\ndaemon with version  < 1.9 or an Another Union File System (Aufs) storage\nbackend. Issue https://github.com/kubernetes/kubernetes/issues/10959 has\nmore details. When `null`, the `serialize_image_pulls_disabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `kubelet_config` sub block.\n', args=[]),
+            new(
+              registry_burst=null,
+              registry_pull_qps=null,
+              serialize_image_pulls_disabled=null
+            ):: std.prune(a={
+              registry_burst: registry_burst,
+              registry_pull_qps: registry_pull_qps,
+              serialize_image_pulls_disabled: serialize_image_pulls_disabled,
+            }),
+          },
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `kubelet_config` (`list[obj]`): The modifiable kubelet configurations for the baremetal machines. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configkubelet_confignew) constructor.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+          new(
+            kubelet_config=null,
+            labels=null,
+            node_configs=null,
+            operating_system=null,
+            taints=null
+          ):: std.prune(a={
+            kubelet_config: kubelet_config,
+            labels: labels,
+            node_configs: node_configs,
+            operating_system: operating_system,
+            taints: taints,
+          }),
+          node_configs:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+            new(
+              labels=null,
+              node_ip=null
+            ):: std.prune(a={
+              labels: labels,
+              node_ip: node_ip,
+            }),
+          },
+          taints:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+            new(
+              effect=null,
+              key=null,
+              value=null
+            ):: std.prune(a={
+              effect: effect,
+              key: key,
+              value: value,
+            }),
+          },
+        },
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new` constructs a new object with attributes and blocks configured for the `bgp_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `asn` (`number`): BGP autonomous system number (ASN) of the cluster.\nThis field can be updated after cluster creation.\n  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer\ntyped services. All addresses must be routable to load balancer nodes.\nIngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.\n  - `bgp_peer_configs` (`list[obj]`): The list of BGP peers that the cluster will connect to.\nAt least one peer must be configured for each control plane node.\nControl plane nodes will connect to these peers to advertise the control\nplane VIP. The Services load balancer also uses these peers by default.\nThis field can be updated after cluster creation. When `null`, the `bgp_peer_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new](#fn-load_balancerload_balancerbgp_peer_configsnew) constructor.\n  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the node pool running data plane load balancing. L2 connectivity\nis required among nodes in this pool. If missing, the control plane node\npool is used for data plane load balancing. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `bgp_lb_config` sub block.\n', args=[]),
+      new(
+        asn,
+        address_pools=null,
+        bgp_peer_configs=null,
+        load_balancer_node_pool_config=null
+      ):: std.prune(a={
+        address_pools: address_pools,
+        asn: asn,
+        bgp_peer_configs: bgp_peer_configs,
+        load_balancer_node_pool_config: load_balancer_node_pool_config,
+      }),
+    },
+    manual_lb_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether manual load balancing is enabled.\n\n**Returns**:\n  - An attribute object that represents the `manual_lb_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    metal_lb_config:: {
+      address_pools:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`\nTerraform sub block.\n\n\n\n**Args**:\n  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).\n  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.\nThis avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.\n  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the address pool.\n\n**Returns**:\n  - An attribute object that represents the `address_pools` sub block.\n', args=[]),
+        new(
+          addresses,
+          pool,
+          avoid_buggy_ips=null,
+          manual_assign=null
+        ):: std.prune(a={
+          addresses: addresses,
+          avoid_buggy_ips: avoid_buggy_ips,
+          manual_assign: manual_assign,
+          pool: pool,
+        }),
+      },
+      load_balancer_node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancermetal_lb_confignode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer_node_pool_config` sub block.\n', args=[]),
+        new(
+          node_pool_config=null
+        ):: std.prune(a={
+          node_pool_config: node_pool_config,
+        }),
+        node_pool_config:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+          new(
+            labels=null,
+            node_configs=null,
+            operating_system=null,
+            taints=null
+          ):: std.prune(a={
+            labels: labels,
+            node_configs: node_configs,
+            operating_system: operating_system,
+            taints: taints,
+          }),
+          node_configs:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+            new(
+              labels=null,
+              node_ip=null
+            ):: std.prune(a={
+              labels: labels,
+              node_ip: node_ip,
+            }),
+          },
+          taints:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+            new(
+              effect=null,
+              key=null,
+              value=null
+            ):: std.prune(a={
+              effect: effect,
+              key: key,
+              value: value,
+            }),
+          },
+        },
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer\ntyped services. All addresses must be routable to load balancer nodes.\nIngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.\n  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the load balancer's node pool configuration. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metal_lb_config` sub block.\n', args=[]),
+      new(
+        address_pools=null,
+        load_balancer_node_pool_config=null
+      ):: std.prune(a={
+        address_pools: address_pools,
+        load_balancer_node_pool_config: load_balancer_node_pool_config,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bgp_lb_config` (`list[obj]`): Configuration for BGP typed load balancers. When `null`, the `bgp_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new](#fn-load_balancerbgp_lb_confignew) constructor.\n  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.\n  - `metal_lb_config` (`list[obj]`): A nested object resource When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.\n  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.\n  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer` sub block.\n', args=[]),
+    new(
+      bgp_lb_config=null,
+      manual_lb_config=null,
+      metal_lb_config=null,
+      port_config=null,
+      vip_config=null
+    ):: std.prune(a={
+      bgp_lb_config: bgp_lb_config,
+      manual_lb_config: manual_lb_config,
+      metal_lb_config: metal_lb_config,
+      port_config: port_config,
+      vip_config: vip_config,
+    }),
+    port_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.\n\n**Returns**:\n  - An attribute object that represents the `port_config` sub block.\n', args=[]),
+      new(
+        control_plane_load_balancer_port
+      ):: std.prune(a={
+        control_plane_load_balancer_port: control_plane_load_balancer_port,
+      }),
+    },
+    vip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal User Cluster.\n  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this Bare Metal User Cluster.\n\n**Returns**:\n  - An attribute object that represents the `vip_config` sub block.\n', args=[]),
+      new(
+        control_plane_vip,
+        ingress_vip
+      ):: std.prune(a={
+        control_plane_vip: control_plane_vip,
+        ingress_vip: ingress_vip,
+      }),
+    },
+  },
+  maintenance_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.\nNodes in maintenance mode will be cordoned and drained. When both of these\nare true, the "baremetal.cluster.gke.io/maintenance" annotation will be set\non the node resource.\n\n**Returns**:\n  - An attribute object that represents the `maintenance_config` sub block.\n', args=[]),
+    new(
+      maintenance_address_cidr_blocks
+    ):: std.prune(a={
+      maintenance_address_cidr_blocks: maintenance_address_cidr_blocks,
+    }),
+  },
+  network_config:: {
+    island_mode_cidr:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n\n**Returns**:\n  - An attribute object that represents the `island_mode_cidr` sub block.\n', args=[]),
+      new(
+        pod_address_cidr_blocks,
+        service_address_cidr_blocks
+      ):: std.prune(a={
+        pod_address_cidr_blocks: pod_address_cidr_blocks,
+        service_address_cidr_blocks: service_address_cidr_blocks,
+      }),
+    },
+    multiple_network_interfaces_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new` constructs a new object with attributes and blocks configured for the `multiple_network_interfaces_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to enable multiple network interfaces for your pods.\nWhen set network_config.advanced_networking is automatically\nset to true. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `multiple_network_interfaces_config` sub block.\n', args=[]),
+      new(
+        enabled=null
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `advanced_networking` (`bool`): Enables the use of advanced Anthos networking features, such as Bundled\nLoad Balancing with BGP or the egress NAT gateway.\nSetting configuration for advanced networking features will automatically\nset this flag. When `null`, the `advanced_networking` field will be omitted from the resulting object.\n  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.\n  - `multiple_network_interfaces_config` (`list[obj]`): Configuration for multiple network interfaces. When `null`, the `multiple_network_interfaces_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new](#fn-network_configmultiple_network_interfaces_confignew) constructor.\n  - `sr_iov_config` (`list[obj]`): Configuration for SR-IOV. When `null`, the `sr_iov_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new](#fn-network_configsr_iov_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      advanced_networking=null,
+      island_mode_cidr=null,
+      multiple_network_interfaces_config=null,
+      sr_iov_config=null
+    ):: std.prune(a={
+      advanced_networking: advanced_networking,
+      island_mode_cidr: island_mode_cidr,
+      multiple_network_interfaces_config: multiple_network_interfaces_config,
+      sr_iov_config: sr_iov_config,
+    }),
+    sr_iov_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new` constructs a new object with attributes and blocks configured for the `sr_iov_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to install the SR-IOV operator. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sr_iov_config` sub block.\n', args=[]),
+      new(
+        enabled=null
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_bare_metal_cluster.new` injects a new `google_gkeonprem_bare_metal_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_bare_metal_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_cluster` using the reference:\n\n    $._ref.google_gkeonprem_bare_metal_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_bare_metal_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.\nThis is the full resource name of the Admin Cluster\u0026#39;s hub membership.\n  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.\n  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal cluster name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_operations` (`list[obj]`): Specifies the User Cluster\u0026#39;s observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    admin_cluster_membership,
+    bare_metal_version,
+    location,
+    name,
+    annotations=null,
+    binary_authorization=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    os_environment_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_bare_metal_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      admin_cluster_membership=admin_cluster_membership,
+      annotations=annotations,
+      bare_metal_version=bare_metal_version,
+      binary_authorization=binary_authorization,
+      cluster_operations=cluster_operations,
+      control_plane=control_plane,
+      description=description,
+      load_balancer=load_balancer,
+      location=location,
+      maintenance_config=maintenance_config,
+      name=name,
+      network_config=network_config,
+      node_access_config=node_access_config,
+      node_config=node_config,
+      os_environment_config=os_environment_config,
+      project=project,
+      proxy=proxy,
+      security_config=security_config,
+      storage=storage,
+      timeouts=timeouts,
+      upgrade_policy=upgrade_policy
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_cluster`\nTerraform resource.\n\nUnlike [google.gkeonprem_bare_metal_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.\nThis is the full resource name of the Admin Cluster's hub membership.\n  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.\n  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal cluster name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_operations` (`list[obj]`): Specifies the User Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    admin_cluster_membership,
+    bare_metal_version,
+    location,
+    name,
+    annotations=null,
+    binary_authorization=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    os_environment_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null
+  ):: std.prune(a={
+    admin_cluster_membership: admin_cluster_membership,
+    annotations: annotations,
+    bare_metal_version: bare_metal_version,
+    binary_authorization: binary_authorization,
+    cluster_operations: cluster_operations,
+    control_plane: control_plane,
+    description: description,
+    load_balancer: load_balancer,
+    location: location,
+    maintenance_config: maintenance_config,
+    name: name,
+    network_config: network_config,
+    node_access_config: node_access_config,
+    node_config: node_config,
+    os_environment_config: os_environment_config,
+    project: project,
+    proxy: proxy,
+    security_config: security_config,
+    storage: storage,
+    timeouts: timeouts,
+    upgrade_policy: upgrade_policy,
+  }),
+  node_access_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `login_user` (`string`): LoginUser is the user name used to access node machines.\nIt defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_access_config` sub block.\n', args=[]),
+    new(
+      login_user=null
+    ):: std.prune(a={
+      login_user: login_user,
+    }),
+  },
+  node_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `container_runtime` (`string`): The available runtimes that can be used to run containers in a Bare Metal User Cluster. Possible values: ["CONTAINER_RUNTIME_UNSPECIFIED", "DOCKER", "CONTAINERD"] When `null`, the `container_runtime` field will be omitted from the resulting object.\n  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range\nassigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      container_runtime=null,
+      max_pods_per_node=null
+    ):: std.prune(a={
+      container_runtime: container_runtime,
+      max_pods_per_node: max_pods_per_node,
+    }),
+  },
+  os_environment_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.os_environment_config.new` constructs a new object with attributes and blocks configured for the `os_environment_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `package_repo_excluded` (`bool`): Whether the package repo should not be included when initializing\nbare metal machines.\n\n**Returns**:\n  - An attribute object that represents the `os_environment_config` sub block.\n', args=[]),
+    new(
+      package_repo_excluded
+    ):: std.prune(a={
+      package_repo_excluded: package_repo_excluded,
+    }),
+  },
+  proxy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.\nExamples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.\n  - `uri` (`string`): Specifies the address of your proxy server.\nExamples: http://domain\nWARNING: Do not provide credentials in the format\nhttp://(username:password@)domain these will be rejected by the server.\n\n**Returns**:\n  - An attribute object that represents the `proxy` sub block.\n', args=[]),
+    new(
+      uri,
+      no_proxy=null
+    ):: std.prune(a={
+      no_proxy: no_proxy,
+      uri: uri,
+    }),
+  },
+  security_config:: {
+    authorization:: {
+      admin_users:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+        new(
+          username
+        ):: std.prune(a={
+          username: username,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+      new(
+        admin_users=null
+      ):: std.prune(a={
+        admin_users: admin_users,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `security_config` sub block.\n', args=[]),
+    new(
+      authorization=null
+    ):: std.prune(a={
+      authorization: authorization,
+    }),
+  },
+  storage:: {
+    lvp_node_mounts_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_node_mounts_config` sub block.\n', args=[]),
+      new(
+        path,
+        storage_class
+      ):: std.prune(a={
+        path: path,
+        storage_class: storage_class,
+      }),
+    },
+    lvp_share_config:: {
+      lvp_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_config` sub block.\n', args=[]),
+        new(
+          path,
+          storage_class
+        ):: std.prune(a={
+          path: path,
+          storage_class: storage_class,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.\n  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `lvp_share_config` sub block.\n', args=[]),
+      new(
+        lvp_config=null,
+        shared_path_pv_count=null
+      ):: std.prune(a={
+        lvp_config: lvp_config,
+        shared_path_pv_count: shared_path_pv_count,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`\nTerraform sub block.\n\n\n\n**Args**:\n  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed\nby mounted node disks. These disks need to be formatted and mounted by the\nuser, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.\n  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by\nsubdirectories in a shared filesystem. These subdirectores are\nautomatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `storage` sub block.\n', args=[]),
+    new(
+      lvp_node_mounts_config=null,
+      lvp_share_config=null
+    ):: std.prune(a={
+      lvp_node_mounts_config: lvp_node_mounts_config,
+      lvp_share_config: lvp_share_config,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  upgrade_policy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `policy` (`string`): Specifies which upgrade policy to use. Possible values: ["SERIAL", "CONCURRENT"] When `null`, the `policy` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `upgrade_policy` sub block.\n', args=[]),
+    new(
+      policy=null
+    ):: std.prune(a={
+      policy: policy,
+    }),
+  },
+  '#withAdminClusterMembership':: d.fn(help='`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the admin_cluster_membership field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `admin_cluster_membership` field.\n', args=[]),
+  withAdminClusterMembership(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          admin_cluster_membership: value,
+        },
+      },
+    },
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withBareMetalVersion':: d.fn(help='`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the bare_metal_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `bare_metal_version` field.\n', args=[]),
+  withBareMetalVersion(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          bare_metal_version: value,
+        },
+      },
+    },
+  },
+  '#withBinaryAuthorization':: d.fn(help='`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorization(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization: value,
+        },
+      },
+    },
+  },
+  '#withBinaryAuthorizationMixin':: d.fn(help='`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withClusterOperations':: d.fn(help='`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations: value,
+        },
+      },
+    },
+  },
+  '#withClusterOperationsMixin':: d.fn(help='`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperationsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlane(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          control_plane: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneMixin':: d.fn(help='`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlaneMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          control_plane+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancer':: d.fn(help='`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancer(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          load_balancer: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancerMixin':: d.fn(help='`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancerMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          load_balancer+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfig':: d.fn(help='`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfigMixin':: d.fn(help='`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfig':: d.fn(help='`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_access_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfigMixin':: d.fn(help='`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_access_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withOsEnvironmentConfig':: d.fn(help='`google.list[obj].withOsEnvironmentConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the os_environment_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withOsEnvironmentConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.\n', args=[]),
+  withOsEnvironmentConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          os_environment_config: value,
+        },
+      },
+    },
+  },
+  '#withOsEnvironmentConfigMixin':: d.fn(help='`google.list[obj].withOsEnvironmentConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the os_environment_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withOsEnvironmentConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.\n', args=[]),
+  withOsEnvironmentConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          os_environment_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withProxy':: d.fn(help='`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          proxy: value,
+        },
+      },
+    },
+  },
+  '#withProxyMixin':: d.fn(help='`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          proxy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withSecurityConfig':: d.fn(help='`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          security_config: value,
+        },
+      },
+    },
+  },
+  '#withSecurityConfigMixin':: d.fn(help='`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          security_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStorage':: d.fn(help='`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorage(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          storage: value,
+        },
+      },
+    },
+  },
+  '#withStorageMixin':: d.fn(help='`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorageMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          storage+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicy':: d.fn(help='`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicyMixin':: d.fn(help='`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_bare_metal_node_pool.libsonnet b/4.x/_gen/resources/gkeonprem_bare_metal_node_pool.libsonnet
new file mode 100644
index 00000000..ec7e33fb
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_bare_metal_node_pool.libsonnet
@@ -0,0 +1,200 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_bare_metal_node_pool', url='', help='`gkeonprem_bare_metal_node_pool` represents the `google_gkeonprem_bare_metal_node_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.gkeonprem_bare_metal_node_pool.new` injects a new `google_gkeonprem_bare_metal_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_bare_metal_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_node_pool` using the reference:\n\n    $._ref.google_gkeonprem_bare_metal_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_bare_metal_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.\n  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal node pool name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    bare_metal_cluster,
+    location,
+    name,
+    annotations=null,
+    display_name=null,
+    node_pool_config=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_bare_metal_node_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      annotations=annotations,
+      bare_metal_cluster=bare_metal_cluster,
+      display_name=display_name,
+      location=location,
+      name=name,
+      node_pool_config=node_pool_config,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_node_pool`\nTerraform resource.\n\nUnlike [google.gkeonprem_bare_metal_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.\n  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal node pool name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    bare_metal_cluster,
+    location,
+    name,
+    annotations=null,
+    display_name=null,
+    node_pool_config=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    annotations: annotations,
+    bare_metal_cluster: bare_metal_cluster,
+    display_name: display_name,
+    location: location,
+    name: name,
+    node_pool_config: node_pool_config,
+    project: project,
+    timeouts: timeouts,
+  }),
+  node_pool_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new](#fn-node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new](#fn-node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+    new(
+      labels=null,
+      node_configs=null,
+      operating_system=null,
+      taints=null
+    ):: std.prune(a={
+      labels: labels,
+      node_configs: node_configs,
+      operating_system: operating_system,
+      taints: taints,
+    }),
+    node_configs:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+      new(
+        labels=null,
+        node_ip=null
+      ):: std.prune(a={
+        labels: labels,
+        node_ip: node_ip,
+      }),
+    },
+    taints:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+      new(
+        effect=null,
+        key=null,
+        value=null
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withBareMetalCluster':: d.fn(help='`google.string.withBareMetalCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the bare_metal_cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `bare_metal_cluster` field.\n', args=[]),
+  withBareMetalCluster(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          bare_metal_cluster: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolConfig':: d.fn(help='`google.list[obj].withNodePoolConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodePoolConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.\n', args=[]),
+  withNodePoolConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_config: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolConfigMixin':: d.fn(help='`google.list[obj].withNodePoolConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.\n', args=[]),
+  withNodePoolConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_vmware_cluster.libsonnet b/4.x/_gen/resources/gkeonprem_vmware_cluster.libsonnet
new file mode 100644
index 00000000..ef67d2b6
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_vmware_cluster.libsonnet
@@ -0,0 +1,694 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_vmware_cluster', url='', help='`gkeonprem_vmware_cluster` represents the `google_gkeonprem_vmware_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  anti_affinity_groups:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.anti_affinity_groups.new` constructs a new object with attributes and blocks configured for the `anti_affinity_groups`\nTerraform sub block.\n\n\n\n**Args**:\n  - `aag_config_disabled` (`bool`): Spread nodes across at least three physical hosts (requires at least three\nhosts).\nEnabled by default.\n\n**Returns**:\n  - An attribute object that represents the `anti_affinity_groups` sub block.\n', args=[]),
+    new(
+      aag_config_disabled
+    ):: std.prune(a={
+      aag_config_disabled: aag_config_disabled,
+    }),
+  },
+  authorization:: {
+    admin_users:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+      new(
+        username
+      ):: std.prune(a={
+        username: username,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing\nfull access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    new(
+      admin_users=null
+    ):: std.prune(a={
+      admin_users: admin_users,
+    }),
+  },
+  auto_repair_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.auto_repair_config.new` constructs a new object with attributes and blocks configured for the `auto_repair_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether auto repair is enabled.\n\n**Returns**:\n  - An attribute object that represents the `auto_repair_config` sub block.\n', args=[]),
+    new(
+      enabled
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
+  control_plane_node:: {
+    auto_resize_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new` constructs a new object with attributes and blocks configured for the `auto_resize_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to enable control plane node auto resizing.\n\n**Returns**:\n  - An attribute object that represents the `auto_resize_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.control_plane_node.new` constructs a new object with attributes and blocks configured for the `control_plane_node`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpus` (`number`): The number of CPUs for each admin cluster node that serve as control planes\nfor this VMware User Cluster. (default: 4 CPUs) When `null`, the `cpus` field will be omitted from the resulting object.\n  - `memory` (`number`): The megabytes of memory for each admin cluster node that serves as a\ncontrol plane for this VMware User Cluster (default: 8192 MB memory). When `null`, the `memory` field will be omitted from the resulting object.\n  - `replicas` (`number`): The number of control plane nodes for this VMware User Cluster.\n(default: 1 replica). When `null`, the `replicas` field will be omitted from the resulting object.\n  - `auto_resize_config` (`list[obj]`): AutoResizeConfig provides auto resizing configurations. When `null`, the `auto_resize_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new](#fn-control_plane_nodeauto_resize_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_node` sub block.\n', args=[]),
+    new(
+      auto_resize_config=null,
+      cpus=null,
+      memory=null,
+      replicas=null
+    ):: std.prune(a={
+      auto_resize_config: auto_resize_config,
+      cpus: cpus,
+      memory: memory,
+      replicas: replicas,
+    }),
+  },
+  dataplane_v2:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.dataplane_v2.new` constructs a new object with attributes and blocks configured for the `dataplane_v2`\nTerraform sub block.\n\n\n\n**Args**:\n  - `advanced_networking` (`bool`): Enable advanced networking which requires dataplane_v2_enabled to be set true. When `null`, the `advanced_networking` field will be omitted from the resulting object.\n  - `dataplane_v2_enabled` (`bool`): Enables Dataplane V2. When `null`, the `dataplane_v2_enabled` field will be omitted from the resulting object.\n  - `windows_dataplane_v2_enabled` (`bool`): Enable Dataplane V2 for clusters with Windows nodes. When `null`, the `windows_dataplane_v2_enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dataplane_v2` sub block.\n', args=[]),
+    new(
+      advanced_networking=null,
+      dataplane_v2_enabled=null,
+      windows_dataplane_v2_enabled=null
+    ):: std.prune(a={
+      advanced_networking: advanced_networking,
+      dataplane_v2_enabled: dataplane_v2_enabled,
+      windows_dataplane_v2_enabled: windows_dataplane_v2_enabled,
+    }),
+  },
+  load_balancer:: {
+    f5_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.f5_config.new` constructs a new object with attributes and blocks configured for the `f5_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The load balancer's IP address. When `null`, the `address` field will be omitted from the resulting object.\n  - `partition` (`string`): he preexisting partition to be used by the load balancer. T\nhis partition is usually created for the admin cluster for example:\n'my-f5-admin-partition'. When `null`, the `partition` field will be omitted from the resulting object.\n  - `snat_pool` (`string`): The pool name. Only necessary, if using SNAT. When `null`, the `snat_pool` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `f5_config` sub block.\n', args=[]),
+      new(
+        address=null,
+        partition=null,
+        snat_pool=null
+      ):: std.prune(a={
+        address: address,
+        partition: partition,
+        snat_pool: snat_pool,
+      }),
+    },
+    manual_lb_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_node_port` (`number`): NodePort for control plane service. The Kubernetes API server in the admin\ncluster is implemented as a Service of type NodePort (ex. 30968). When `null`, the `control_plane_node_port` field will be omitted from the resulting object.\n  - `ingress_http_node_port` (`number`): NodePort for ingress service's http. The ingress service in the admin\ncluster is implemented as a Service of type NodePort (ex. 32527). When `null`, the `ingress_http_node_port` field will be omitted from the resulting object.\n  - `ingress_https_node_port` (`number`): NodePort for ingress service's https. The ingress service in the admin\ncluster is implemented as a Service of type NodePort (ex. 30139). When `null`, the `ingress_https_node_port` field will be omitted from the resulting object.\n  - `konnectivity_server_node_port` (`number`): NodePort for konnectivity server service running as a sidecar in each\nkube-apiserver pod (ex. 30564). When `null`, the `konnectivity_server_node_port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `manual_lb_config` sub block.\n', args=[]),
+      new(
+        control_plane_node_port=null,
+        ingress_http_node_port=null,
+        ingress_https_node_port=null,
+        konnectivity_server_node_port=null
+      ):: std.prune(a={
+        control_plane_node_port: control_plane_node_port,
+        ingress_http_node_port: ingress_http_node_port,
+        ingress_https_node_port: ingress_https_node_port,
+        konnectivity_server_node_port: konnectivity_server_node_port,
+      }),
+    },
+    metal_lb_config:: {
+      address_pools:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`\nTerraform sub block.\n\n\n\n**Args**:\n  - `addresses` (`list`): The addresses that are part of this pool. Each address\nmust be either in the CIDR form (1.2.3.0/24) or range\nform (1.2.3.1-1.2.3.5).\n  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.\nThis avoids buggy consumer devices mistakenly dropping IPv4 traffic for\nthose special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.\n  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the address pool.\n\n**Returns**:\n  - An attribute object that represents the `address_pools` sub block.\n', args=[]),
+        new(
+          addresses,
+          pool,
+          avoid_buggy_ips=null,
+          manual_assign=null
+        ):: std.prune(a={
+          addresses: addresses,
+          avoid_buggy_ips: avoid_buggy_ips,
+          manual_assign: manual_assign,
+          pool: pool,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer\ntyped services. All addresses must be routable to load balancer nodes.\nIngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metal_lb_config` sub block.\n', args=[]),
+      new(
+        address_pools=null
+      ):: std.prune(a={
+        address_pools: address_pools,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `f5_config` (`list[obj]`): Configuration for F5 Big IP typed load balancers. When `null`, the `f5_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.f5_config.new](#fn-load_balancerf5_confignew) constructor.\n  - `manual_lb_config` (`list[obj]`): Manually configured load balancers. When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.\n  - `metal_lb_config` (`list[obj]`): Configuration for MetalLB typed load balancers. When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.\n  - `vip_config` (`list[obj]`): The VIPs used by the load balancer. When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer` sub block.\n', args=[]),
+    new(
+      f5_config=null,
+      manual_lb_config=null,
+      metal_lb_config=null,
+      vip_config=null
+    ):: std.prune(a={
+      f5_config: f5_config,
+      manual_lb_config: manual_lb_config,
+      metal_lb_config: metal_lb_config,
+      vip_config: vip_config,
+    }),
+    vip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this cluster. When `null`, the `control_plane_vip` field will be omitted from the resulting object.\n  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this cluster. When `null`, the `ingress_vip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vip_config` sub block.\n', args=[]),
+      new(
+        control_plane_vip=null,
+        ingress_vip=null
+      ):: std.prune(a={
+        control_plane_vip: control_plane_vip,
+        ingress_vip: ingress_vip,
+      }),
+    },
+  },
+  network_config:: {
+    control_plane_v2_config:: {
+      control_plane_ip_block:: {
+        ips:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new` constructs a new object with attributes and blocks configured for the `ips`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24). When `null`, the `ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ips` sub block.\n', args=[]),
+          new(
+            hostname=null,
+            ip=null
+          ):: std.prune(a={
+            hostname: hostname,
+            ip: ip,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new` constructs a new object with attributes and blocks configured for the `control_plane_ip_block`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gateway` (`string`): The network gateway used by the VMware User Cluster. When `null`, the `gateway` field will be omitted from the resulting object.\n  - `netmask` (`string`): The netmask used by the VMware User Cluster. When `null`, the `netmask` field will be omitted from the resulting object.\n  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new](#fn-network_confignetwork_configcontrol_plane_v2_configipsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_ip_block` sub block.\n', args=[]),
+        new(
+          gateway=null,
+          ips=null,
+          netmask=null
+        ):: std.prune(a={
+          gateway: gateway,
+          ips: ips,
+          netmask: netmask,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new` constructs a new object with attributes and blocks configured for the `control_plane_v2_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_ip_block` (`list[obj]`): Static IP addresses for the control plane nodes. When `null`, the `control_plane_ip_block` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new](#fn-network_confignetwork_configcontrol_plane_ip_blocknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_v2_config` sub block.\n', args=[]),
+      new(
+        control_plane_ip_block=null
+      ):: std.prune(a={
+        control_plane_ip_block: control_plane_ip_block,
+      }),
+    },
+    dhcp_ip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new` constructs a new object with attributes and blocks configured for the `dhcp_ip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): enabled is a flag to mark if DHCP IP allocation is\nused for VMware user clusters.\n\n**Returns**:\n  - An attribute object that represents the `dhcp_ip_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    host_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.host_config.new` constructs a new object with attributes and blocks configured for the `host_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dns_search_domains` (`list`): DNS search domains. When `null`, the `dns_search_domains` field will be omitted from the resulting object.\n  - `dns_servers` (`list`): DNS servers. When `null`, the `dns_servers` field will be omitted from the resulting object.\n  - `ntp_servers` (`list`): NTP servers. When `null`, the `ntp_servers` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `host_config` sub block.\n', args=[]),
+      new(
+        dns_search_domains=null,
+        dns_servers=null,
+        ntp_servers=null
+      ):: std.prune(a={
+        dns_search_domains: dns_search_domains,
+        dns_servers: dns_servers,
+        ntp_servers: ntp_servers,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges.\nOnly a single range is supported. This field cannot be changed after creation.\n  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address\nfrom these ranges. Only a single range is supported.. This field\ncannot be changed after creation.\n  - `control_plane_v2_config` (`list[obj]`): Configuration for control plane V2 mode. When `null`, the `control_plane_v2_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new](#fn-network_configcontrol_plane_v2_confignew) constructor.\n  - `dhcp_ip_config` (`list[obj]`): Configuration settings for a DHCP IP configuration. When `null`, the `dhcp_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new](#fn-network_configdhcp_ip_confignew) constructor.\n  - `host_config` (`list[obj]`): Represents common network settings irrespective of the host's IP address. When `null`, the `host_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.host_config.new](#fn-network_confighost_confignew) constructor.\n  - `static_ip_config` (`list[obj]`): Configuration settings for a static IP configuration. When `null`, the `static_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.new](#fn-network_configstatic_ip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      pod_address_cidr_blocks,
+      service_address_cidr_blocks,
+      control_plane_v2_config=null,
+      dhcp_ip_config=null,
+      host_config=null,
+      static_ip_config=null
+    ):: std.prune(a={
+      control_plane_v2_config: control_plane_v2_config,
+      dhcp_ip_config: dhcp_ip_config,
+      host_config: host_config,
+      pod_address_cidr_blocks: pod_address_cidr_blocks,
+      service_address_cidr_blocks: service_address_cidr_blocks,
+      static_ip_config: static_ip_config,
+    }),
+    static_ip_config:: {
+      ip_blocks:: {
+        ips:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new` constructs a new object with attributes and blocks configured for the `ips`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24).\n\n**Returns**:\n  - An attribute object that represents the `ips` sub block.\n', args=[]),
+          new(
+            ip,
+            hostname=null
+          ):: std.prune(a={
+            hostname: hostname,
+            ip: ip,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new` constructs a new object with attributes and blocks configured for the `ip_blocks`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gateway` (`string`): The network gateway used by the VMware User Cluster.\n  - `netmask` (`string`): The netmask used by the VMware User Cluster.\n  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new](#fn-network_confignetwork_configstatic_ip_configipsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ip_blocks` sub block.\n', args=[]),
+        new(
+          gateway,
+          netmask,
+          ips=null
+        ):: std.prune(a={
+          gateway: gateway,
+          ips: ips,
+          netmask: netmask,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.static_ip_config.new` constructs a new object with attributes and blocks configured for the `static_ip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_blocks` (`list[obj]`): Represents the configuration values for static IP allocation to nodes. When `null`, the `ip_blocks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new](#fn-network_confignetwork_configip_blocksnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `static_ip_config` sub block.\n', args=[]),
+      new(
+        ip_blocks=null
+      ):: std.prune(a={
+        ip_blocks: ip_blocks,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_vmware_cluster.new` injects a new `google_gkeonprem_vmware_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_vmware_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_vmware_cluster` using the reference:\n\n    $._ref.google_gkeonprem_vmware_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_vmware_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.\nThis is the full resource name of the admin cluster\u0026#39;s hub membership.\nIn the future, references to other resource types might be allowed if\nadmin clusters are modeled as their own resources.\n  - `annotations` (`obj`): Annotations on the VMware User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The VMware cluster name.\n  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.\n  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at\nleast three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.\n  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.\n  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.\n  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.\nInherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    admin_cluster_membership,
+    location,
+    name,
+    on_prem_version,
+    annotations=null,
+    anti_affinity_groups=null,
+    authorization=null,
+    auto_repair_config=null,
+    control_plane_node=null,
+    dataplane_v2=null,
+    description=null,
+    enable_control_plane_v2=null,
+    load_balancer=null,
+    network_config=null,
+    project=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null,
+    vcenter=null,
+    vm_tracking_enabled=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_vmware_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      admin_cluster_membership=admin_cluster_membership,
+      annotations=annotations,
+      anti_affinity_groups=anti_affinity_groups,
+      authorization=authorization,
+      auto_repair_config=auto_repair_config,
+      control_plane_node=control_plane_node,
+      dataplane_v2=dataplane_v2,
+      description=description,
+      enable_control_plane_v2=enable_control_plane_v2,
+      load_balancer=load_balancer,
+      location=location,
+      name=name,
+      network_config=network_config,
+      on_prem_version=on_prem_version,
+      project=project,
+      storage=storage,
+      timeouts=timeouts,
+      upgrade_policy=upgrade_policy,
+      vcenter=vcenter,
+      vm_tracking_enabled=vm_tracking_enabled
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_vmware_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_cluster`\nTerraform resource.\n\nUnlike [google.gkeonprem_vmware_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.\nThis is the full resource name of the admin cluster's hub membership.\nIn the future, references to other resource types might be allowed if\nadmin clusters are modeled as their own resources.\n  - `annotations` (`obj`): Annotations on the VMware User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The VMware cluster name.\n  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.\n  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at\nleast three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.\n  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.\n  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.\n  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.\nInherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    admin_cluster_membership,
+    location,
+    name,
+    on_prem_version,
+    annotations=null,
+    anti_affinity_groups=null,
+    authorization=null,
+    auto_repair_config=null,
+    control_plane_node=null,
+    dataplane_v2=null,
+    description=null,
+    enable_control_plane_v2=null,
+    load_balancer=null,
+    network_config=null,
+    project=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null,
+    vcenter=null,
+    vm_tracking_enabled=null
+  ):: std.prune(a={
+    admin_cluster_membership: admin_cluster_membership,
+    annotations: annotations,
+    anti_affinity_groups: anti_affinity_groups,
+    authorization: authorization,
+    auto_repair_config: auto_repair_config,
+    control_plane_node: control_plane_node,
+    dataplane_v2: dataplane_v2,
+    description: description,
+    enable_control_plane_v2: enable_control_plane_v2,
+    load_balancer: load_balancer,
+    location: location,
+    name: name,
+    network_config: network_config,
+    on_prem_version: on_prem_version,
+    project: project,
+    storage: storage,
+    timeouts: timeouts,
+    upgrade_policy: upgrade_policy,
+    vcenter: vcenter,
+    vm_tracking_enabled: vm_tracking_enabled,
+  }),
+  storage:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vsphere_csi_disabled` (`bool`): Whether or not to deploy vSphere CSI components in the VMware User Cluster.\nEnabled by default.\n\n**Returns**:\n  - An attribute object that represents the `storage` sub block.\n', args=[]),
+    new(
+      vsphere_csi_disabled
+    ):: std.prune(a={
+      vsphere_csi_disabled: vsphere_csi_disabled,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  upgrade_policy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_only` (`bool`): Controls whether the upgrade applies to the control plane only. When `null`, the `control_plane_only` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `upgrade_policy` sub block.\n', args=[]),
+    new(
+      control_plane_only=null
+    ):: std.prune(a={
+      control_plane_only: control_plane_only,
+    }),
+  },
+  vcenter:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.vcenter.new` constructs a new object with attributes and blocks configured for the `vcenter`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ca_cert_data` (`string`): Contains the vCenter CA certificate public key for SSL verification. When `null`, the `ca_cert_data` field will be omitted from the resulting object.\n  - `cluster` (`string`): The name of the vCenter cluster for the user cluster. When `null`, the `cluster` field will be omitted from the resulting object.\n  - `datacenter` (`string`): The name of the vCenter datacenter for the user cluster. When `null`, the `datacenter` field will be omitted from the resulting object.\n  - `datastore` (`string`): The name of the vCenter datastore for the user cluster. When `null`, the `datastore` field will be omitted from the resulting object.\n  - `folder` (`string`): The name of the vCenter folder for the user cluster. When `null`, the `folder` field will be omitted from the resulting object.\n  - `resource_pool` (`string`): The name of the vCenter resource pool for the user cluster. When `null`, the `resource_pool` field will be omitted from the resulting object.\n  - `storage_policy_name` (`string`): The name of the vCenter storage policy for the user cluster. When `null`, the `storage_policy_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vcenter` sub block.\n', args=[]),
+    new(
+      ca_cert_data=null,
+      cluster=null,
+      datacenter=null,
+      datastore=null,
+      folder=null,
+      resource_pool=null,
+      storage_policy_name=null
+    ):: std.prune(a={
+      ca_cert_data: ca_cert_data,
+      cluster: cluster,
+      datacenter: datacenter,
+      datastore: datastore,
+      folder: folder,
+      resource_pool: resource_pool,
+      storage_policy_name: storage_policy_name,
+    }),
+  },
+  '#withAdminClusterMembership':: d.fn(help='`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the admin_cluster_membership field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `admin_cluster_membership` field.\n', args=[]),
+  withAdminClusterMembership(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          admin_cluster_membership: value,
+        },
+      },
+    },
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withAntiAffinityGroups':: d.fn(help='`google.list[obj].withAntiAffinityGroups` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the anti_affinity_groups field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAntiAffinityGroupsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.\n', args=[]),
+  withAntiAffinityGroups(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          anti_affinity_groups: value,
+        },
+      },
+    },
+  },
+  '#withAntiAffinityGroupsMixin':: d.fn(help='`google.list[obj].withAntiAffinityGroupsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the anti_affinity_groups field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAntiAffinityGroups](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.\n', args=[]),
+  withAntiAffinityGroupsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          anti_affinity_groups+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withAuthorization':: d.fn(help='`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorization(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          authorization: value,
+        },
+      },
+    },
+  },
+  '#withAuthorizationMixin':: d.fn(help='`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withAutoRepairConfig':: d.fn(help='`google.list[obj].withAutoRepairConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the auto_repair_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAutoRepairConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.\n', args=[]),
+  withAutoRepairConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          auto_repair_config: value,
+        },
+      },
+    },
+  },
+  '#withAutoRepairConfigMixin':: d.fn(help='`google.list[obj].withAutoRepairConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the auto_repair_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAutoRepairConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.\n', args=[]),
+  withAutoRepairConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          auto_repair_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlaneNode':: d.fn(help='`google.list[obj].withControlPlaneNode` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_node field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneNodeMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.\n', args=[]),
+  withControlPlaneNode(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          control_plane_node: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneNodeMixin':: d.fn(help='`google.list[obj].withControlPlaneNodeMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_node field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneNode](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.\n', args=[]),
+  withControlPlaneNodeMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          control_plane_node+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataplaneV2':: d.fn(help='`google.list[obj].withDataplaneV2` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dataplane_v2 field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDataplaneV2Mixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.\n', args=[]),
+  withDataplaneV2(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          dataplane_v2: value,
+        },
+      },
+    },
+  },
+  '#withDataplaneV2Mixin':: d.fn(help='`google.list[obj].withDataplaneV2Mixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dataplane_v2 field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDataplaneV2](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.\n', args=[]),
+  withDataplaneV2Mixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          dataplane_v2+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withEnableControlPlaneV2':: d.fn(help='`google.bool.withEnableControlPlaneV2` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_control_plane_v2 field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_control_plane_v2` field.\n', args=[]),
+  withEnableControlPlaneV2(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          enable_control_plane_v2: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancer':: d.fn(help='`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancer(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          load_balancer: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancerMixin':: d.fn(help='`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancerMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          load_balancer+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withOnPremVersion':: d.fn(help='`google.string.withOnPremVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the on_prem_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `on_prem_version` field.\n', args=[]),
+  withOnPremVersion(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          on_prem_version: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withStorage':: d.fn(help='`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorage(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          storage: value,
+        },
+      },
+    },
+  },
+  '#withStorageMixin':: d.fn(help='`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorageMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          storage+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicy':: d.fn(help='`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicyMixin':: d.fn(help='`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withVcenter':: d.fn(help='`google.list[obj].withVcenter` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vcenter field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVcenterMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vcenter` field.\n', args=[]),
+  withVcenter(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          vcenter: value,
+        },
+      },
+    },
+  },
+  '#withVcenterMixin':: d.fn(help='`google.list[obj].withVcenterMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vcenter field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVcenter](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vcenter` field.\n', args=[]),
+  withVcenterMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          vcenter+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withVmTrackingEnabled':: d.fn(help='`google.bool.withVmTrackingEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the vm_tracking_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `vm_tracking_enabled` field.\n', args=[]),
+  withVmTrackingEnabled(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          vm_tracking_enabled: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_vmware_node_pool.libsonnet b/4.x/_gen/resources/gkeonprem_vmware_node_pool.libsonnet
new file mode 100644
index 00000000..5571313a
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_vmware_node_pool.libsonnet
@@ -0,0 +1,258 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_vmware_node_pool', url='', help='`gkeonprem_vmware_node_pool` represents the `google_gkeonprem_vmware_node_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): VMware disk size to be used during creation. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `cpus` (`number`): The number of CPUs for each node in the node pool. When `null`, the `cpus` field will be omitted from the resulting object.\n  - `enable_load_balancer` (`bool`): Allow node pool traffic to be load balanced. Only works for clusters with\nMetalLB load balancers. When `null`, the `enable_load_balancer` field will be omitted from the resulting object.\n  - `image` (`string`): The OS image name in vCenter, only valid when using Windows. When `null`, the `image` field will be omitted from the resulting object.\n  - `image_type` (`string`): The OS image to be used for each node in a node pool.\nCurrently 'cos', 'ubuntu', 'ubuntu_containerd' and 'windows' are supported.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node.\nThese will added in addition to any default label(s) that\nKubernetes may apply to the node.\nIn case of conflict in label keys, the applied set may differ depending on\nthe Kubernetes version -- it's best to assume the behavior is undefined\nand conflicts should be avoided. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memory_mb` (`number`): The megabytes of memory for each node in the node pool. When `null`, the `memory_mb` field will be omitted from the resulting object.\n  - `replicas` (`number`): The number of nodes in the node pool. When `null`, the `replicas` field will be omitted from the resulting object.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.taints.new](#fn-configtaintsnew) constructor.\n  - `vsphere_config` (`list[obj]`): Specifies the vSphere config for node pool. When `null`, the `vsphere_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.vsphere_config.new](#fn-configvsphere_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
+    new(
+      image_type,
+      boot_disk_size_gb=null,
+      cpus=null,
+      enable_load_balancer=null,
+      image=null,
+      labels=null,
+      memory_mb=null,
+      replicas=null,
+      taints=null,
+      vsphere_config=null
+    ):: std.prune(a={
+      boot_disk_size_gb: boot_disk_size_gb,
+      cpus: cpus,
+      enable_load_balancer: enable_load_balancer,
+      image: image,
+      image_type: image_type,
+      labels: labels,
+      memory_mb: memory_mb,
+      replicas: replicas,
+      taints: taints,
+      vsphere_config: vsphere_config,
+    }),
+    taints:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Available taint effects. Possible values: ["EFFECT_UNSPECIFIED", "NO_SCHEDULE", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect.\n  - `value` (`string`): Value associated with the effect.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+      new(
+        key,
+        value,
+        effect=null
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
+    vsphere_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.config.vsphere_config.new` constructs a new object with attributes and blocks configured for the `vsphere_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `datastore` (`string`): The name of the vCenter datastore. Inherited from the user cluster. When `null`, the `datastore` field will be omitted from the resulting object.\n  - `host_groups` (`list`): Vsphere host groups to apply to all VMs in the node pool When `null`, the `host_groups` field will be omitted from the resulting object.\n  - `tags` (`list[obj]`): Tags to apply to VMs. When `null`, the `tags` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.vsphere_config.tags.new](#fn-configconfigtagsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vsphere_config` sub block.\n', args=[]),
+      new(
+        datastore=null,
+        host_groups=null,
+        tags=null
+      ):: std.prune(a={
+        datastore: datastore,
+        host_groups: host_groups,
+        tags: tags,
+      }),
+      tags:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.config.vsphere_config.tags.new` constructs a new object with attributes and blocks configured for the `tags`\nTerraform sub block.\n\n\n\n**Args**:\n  - `category` (`string`): The Vsphere tag category. When `null`, the `category` field will be omitted from the resulting object.\n  - `tag` (`string`): The Vsphere tag name. When `null`, the `tag` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tags` sub block.\n', args=[]),
+        new(
+          category=null,
+          tag=null
+        ):: std.prune(a={
+          category: category,
+          tag: tag,
+        }),
+      },
+    },
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_vmware_node_pool.new` injects a new `google_gkeonprem_vmware_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_vmware_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_vmware_node_pool` using the reference:\n\n    $._ref.google_gkeonprem_vmware_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_vmware_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations on the node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The vmware node pool name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_cluster` (`string`): The cluster this node pool belongs to.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.\n  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    vmware_cluster,
+    annotations=null,
+    config=null,
+    display_name=null,
+    node_pool_autoscaling=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_vmware_node_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      annotations=annotations,
+      config=config,
+      display_name=display_name,
+      location=location,
+      name=name,
+      node_pool_autoscaling=node_pool_autoscaling,
+      project=project,
+      timeouts=timeouts,
+      vmware_cluster=vmware_cluster
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_node_pool`\nTerraform resource.\n\nUnlike [google.gkeonprem_vmware_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations on the node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The vmware node pool name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_cluster` (`string`): The cluster this node pool belongs to.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.\n  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    vmware_cluster,
+    annotations=null,
+    config=null,
+    display_name=null,
+    node_pool_autoscaling=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    annotations: annotations,
+    config: config,
+    display_name: display_name,
+    location: location,
+    name: name,
+    node_pool_autoscaling: node_pool_autoscaling,
+    project: project,
+    timeouts: timeouts,
+    vmware_cluster: vmware_cluster,
+  }),
+  node_pool_autoscaling:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new` constructs a new object with attributes and blocks configured for the `node_pool_autoscaling`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_replicas` (`number`): Maximum number of replicas in the NodePool.\n  - `min_replicas` (`number`): Minimum number of replicas in the NodePool.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_autoscaling` sub block.\n', args=[]),
+    new(
+      max_replicas,
+      min_replicas
+    ):: std.prune(a={
+      max_replicas: max_replicas,
+      min_replicas: min_replicas,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withConfig':: d.fn(help='`google.list[obj].withConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `config` field.\n', args=[]),
+  withConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          config: value,
+        },
+      },
+    },
+  },
+  '#withConfigMixin':: d.fn(help='`google.list[obj].withConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `config` field.\n', args=[]),
+  withConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolAutoscaling':: d.fn(help='`google.list[obj].withNodePoolAutoscaling` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_autoscaling field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodePoolAutoscalingMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.\n', args=[]),
+  withNodePoolAutoscaling(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_autoscaling: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolAutoscalingMixin':: d.fn(help='`google.list[obj].withNodePoolAutoscalingMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_autoscaling field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolAutoscaling](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.\n', args=[]),
+  withNodePoolAutoscalingMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_autoscaling+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVmwareCluster':: d.fn(help='`google.string.withVmwareCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the vmware_cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `vmware_cluster` field.\n', args=[]),
+  withVmwareCluster(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          vmware_cluster: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/healthcare_consent_store.libsonnet b/4.x/_gen/resources/healthcare_consent_store.libsonnet
index e779f4d9..5b4eafba 100644
--- a/4.x/_gen/resources/healthcare_consent_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_consent_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_consent_store', url='', help='`healthcare_consent_store` represents the `google_healthcare_consent_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_consent_store.new` injects a new `google_healthcare_consent_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_consent_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_consent_store` using the reference:\n\n    $._ref.google_healthcare_consent_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_consent_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\u0026#39;\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\u0026#39;\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n\u0026#34;consent1\u0026#34;\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_consent_store.new` injects a new `google_healthcare_consent_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_consent_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_consent_store` using the reference:\n\n    $._ref.google_healthcare_consent_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_consent_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\u0026#39;\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\u0026#39;\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n\u0026#34;consent1\u0026#34;\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_consent_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_consent_store`\nTerraform resource.\n\nUnlike [google.healthcare_consent_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}'\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}'\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n"consent1"\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_consent_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_consent_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_consent_store`\nTerraform resource.\n\nUnlike [google.healthcare_consent_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}'\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}'\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n"consent1"\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_consent_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/healthcare_dicom_store.libsonnet b/4.x/_gen/resources/healthcare_dicom_store.libsonnet
index 7e442021..a18849e1 100644
--- a/4.x/_gen/resources/healthcare_dicom_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_dicom_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_dicom_store', url='', help='`healthcare_dicom_store` represents the `google_healthcare_dicom_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_dicom_store.new` injects a new `google_healthcare_dicom_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_dicom_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_dicom_store` using the reference:\n\n    $._ref.google_healthcare_dicom_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_dicom_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_dicom_store.new` injects a new `google_healthcare_dicom_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_dicom_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_dicom_store` using the reference:\n\n    $._ref.google_healthcare_dicom_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_dicom_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_dicom_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_dicom_store`\nTerraform resource.\n\nUnlike [google.healthcare_dicom_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_dicom_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_dicom_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_dicom_store`\nTerraform resource.\n\nUnlike [google.healthcare_dicom_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_dicom_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/healthcare_fhir_store.libsonnet b/4.x/_gen/resources/healthcare_fhir_store.libsonnet
index 3a295c9b..5464d853 100644
--- a/4.x/_gen/resources/healthcare_fhir_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_fhir_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_fhir_store', url='', help='`healthcare_fhir_store` represents the `google_healthcare_fhir_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_fhir_store.new` injects a new `google_healthcare_fhir_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_fhir_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_fhir_store` using the reference:\n\n    $._ref.google_healthcare_fhir_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_fhir_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: [\u0026#34;COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED\u0026#34;, \u0026#34;DISABLED\u0026#34;, \u0026#34;ENABLED\u0026#34;] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: [\u0026#34;DSTU2\u0026#34;, \u0026#34;STU3\u0026#34;, \u0026#34;R4\u0026#34;]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project\u0026#39;s Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_fhir_store.new` injects a new `google_healthcare_fhir_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_fhir_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_fhir_store` using the reference:\n\n    $._ref.google_healthcare_fhir_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_fhir_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: [\u0026#34;COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED\u0026#34;, \u0026#34;DISABLED\u0026#34;, \u0026#34;ENABLED\u0026#34;] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: [\u0026#34;DSTU2\u0026#34;, \u0026#34;STU3\u0026#34;, \u0026#34;R4\u0026#34;]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project\u0026#39;s Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_fhir_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_fhir_store`\nTerraform resource.\n\nUnlike [google.healthcare_fhir_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: ["COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED", "DISABLED", "ENABLED"] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: ["DSTU2", "STU3", "R4"]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project's Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_fhir_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_fhir_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_fhir_store`\nTerraform resource.\n\nUnlike [google.healthcare_fhir_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: ["COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED", "DISABLED", "ENABLED"] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: ["DSTU2", "STU3", "R4"]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project's Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_fhir_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet b/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet
index 019bdaf2..6eed6ec0 100644
--- a/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_hl7_v2_store', url='', help='`healthcare_hl7_v2_store` represents the `google_healthcare_hl7_v2_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_hl7_v2_store.new` injects a new `google_healthcare_hl7_v2_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_hl7_v2_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_hl7_v2_store` using the reference:\n\n    $._ref.google_healthcare_hl7_v2_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_hl7_v2_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest \u0026amp; Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_hl7_v2_store.new` injects a new `google_healthcare_hl7_v2_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_hl7_v2_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_hl7_v2_store` using the reference:\n\n    $._ref.google_healthcare_hl7_v2_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_hl7_v2_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest \u0026amp; Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_hl7_v2_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_hl7_v2_store`\nTerraform resource.\n\nUnlike [google.healthcare_hl7_v2_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest & Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_hl7_v2_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_hl7_v2_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_hl7_v2_store`\nTerraform resource.\n\nUnlike [google.healthcare_hl7_v2_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest & Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_hl7_v2_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/iam_workforce_pool.libsonnet b/4.x/_gen/resources/iam_workforce_pool.libsonnet
index 6d4512cd..9e356a70 100644
--- a/4.x/_gen/resources/iam_workforce_pool.libsonnet
+++ b/4.x/_gen/resources/iam_workforce_pool.libsonnet
@@ -2,12 +2,31 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='iam_workforce_pool', url='', help='`iam_workforce_pool` represents the `google_iam_workforce_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.iam_workforce_pool.new` injects a new `google_iam_workforce_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.iam_workforce_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.iam_workforce_pool` using the reference:\n\n    $._ref.google_iam_workforce_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_iam_workforce_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A user-specified description of the pool. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,\nor use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource.\n  - `parent` (`string`): Immutable. The resource name of the parent. Format: \u0026#39;organizations/{org-id}\u0026#39;.\n  - `session_duration` (`string`): Duration that the Google Cloud access tokens, console sign-in sessions,\nand \u0026#39;gcloud\u0026#39; sign-in sessions from this pool are valid.\nMust be greater than 15 minutes (900s) and less than 12 hours (43200s).\nIf \u0026#39;sessionDuration\u0026#39; is not configured, minted credentials have a default duration of one hour (3600s).\nA duration in seconds with up to nine fractional digits, ending with \u0026#39;\u0026#39;s\u0026#39;\u0026#39;. Example: \u0026#34;\u0026#39;3.5s\u0026#39;\u0026#34;. When `null`, the `session_duration` field will be omitted from the resulting object.\n  - `workforce_pool_id` (`string`): The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,\ndigits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.\nThe prefix \u0026#39;gcp-\u0026#39; is reserved for use by Google, and may not be specified.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  access_restrictions:: {
+    allowed_services:: {
+      '#new':: d.fn(help='\n`google.iam_workforce_pool.access_restrictions.allowed_services.new` constructs a new object with attributes and blocks configured for the `allowed_services`\nTerraform sub block.\n\n\n\n**Args**:\n  - `domain` (`string`): Domain name of the service.\nExample: console.cloud.google When `null`, the `domain` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `allowed_services` sub block.\n', args=[]),
+      new(
+        domain=null
+      ):: std.prune(a={
+        domain: domain,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.iam_workforce_pool.access_restrictions.new` constructs a new object with attributes and blocks configured for the `access_restrictions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disable_programmatic_signin` (`bool`): Disable programmatic sign-in by disabling token issue via the Security Token API endpoint.\nSee [Security Token Service API](https://cloud.google.com/iam/docs/reference/sts/rest). When `null`, the `disable_programmatic_signin` field will be omitted from the resulting object.\n  - `allowed_services` (`list[obj]`): Services allowed for web sign-in with the workforce pool.\nIf not set by default there are no restrictions. When `null`, the `allowed_services` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.access_restrictions.allowed_services.new](#fn-access_restrictionsallowed_servicesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `access_restrictions` sub block.\n', args=[]),
+    new(
+      allowed_services=null,
+      disable_programmatic_signin=null
+    ):: std.prune(a={
+      allowed_services: allowed_services,
+      disable_programmatic_signin: disable_programmatic_signin,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.iam_workforce_pool.new` injects a new `google_iam_workforce_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.iam_workforce_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.iam_workforce_pool` using the reference:\n\n    $._ref.google_iam_workforce_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_iam_workforce_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A user-specified description of the pool. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,\nor use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource.\n  - `parent` (`string`): Immutable. The resource name of the parent. Format: \u0026#39;organizations/{org-id}\u0026#39;.\n  - `session_duration` (`string`): Duration that the Google Cloud access tokens, console sign-in sessions,\nand \u0026#39;gcloud\u0026#39; sign-in sessions from this pool are valid.\nMust be greater than 15 minutes (900s) and less than 12 hours (43200s).\nIf \u0026#39;sessionDuration\u0026#39; is not configured, minted credentials have a default duration of one hour (3600s).\nA duration in seconds with up to nine fractional digits, ending with \u0026#39;\u0026#39;s\u0026#39;\u0026#39;. Example: \u0026#34;\u0026#39;3.5s\u0026#39;\u0026#34;. When `null`, the `session_duration` field will be omitted from the resulting object.\n  - `workforce_pool_id` (`string`): The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,\ndigits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.\nThe prefix \u0026#39;gcp-\u0026#39; is reserved for use by Google, and may not be specified.\n  - `access_restrictions` (`list[obj]`): Configure access restrictions on the workforce pool users. This is an optional field. If specified web\nsign-in can be restricted to given set of services or programmatic sign-in can be disabled for pool users. When `null`, the `access_restrictions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.access_restrictions.new](#fn-access_restrictionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
     parent,
     workforce_pool_id,
+    access_restrictions=null,
     description=null,
     disabled=null,
     display_name=null,
@@ -18,6 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_iam_workforce_pool',
     label=resourceLabel,
     attrs=self.newAttrs(
+      access_restrictions=access_restrictions,
       description=description,
       disabled=disabled,
       display_name=display_name,
@@ -29,17 +49,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.iam_workforce_pool.newAttrs` constructs a new object with attributes and blocks configured for the `iam_workforce_pool`\nTerraform resource.\n\nUnlike [google.iam_workforce_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A user-specified description of the pool. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,\nor use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource.\n  - `parent` (`string`): Immutable. The resource name of the parent. Format: 'organizations/{org-id}'.\n  - `session_duration` (`string`): Duration that the Google Cloud access tokens, console sign-in sessions,\nand 'gcloud' sign-in sessions from this pool are valid.\nMust be greater than 15 minutes (900s) and less than 12 hours (43200s).\nIf 'sessionDuration' is not configured, minted credentials have a default duration of one hour (3600s).\nA duration in seconds with up to nine fractional digits, ending with ''s''. Example: "'3.5s'". When `null`, the `session_duration` field will be omitted from the resulting object.\n  - `workforce_pool_id` (`string`): The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,\ndigits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.\nThe prefix 'gcp-' is reserved for use by Google, and may not be specified.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `iam_workforce_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.iam_workforce_pool.newAttrs` constructs a new object with attributes and blocks configured for the `iam_workforce_pool`\nTerraform resource.\n\nUnlike [google.iam_workforce_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A user-specified description of the pool. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,\nor use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource.\n  - `parent` (`string`): Immutable. The resource name of the parent. Format: 'organizations/{org-id}'.\n  - `session_duration` (`string`): Duration that the Google Cloud access tokens, console sign-in sessions,\nand 'gcloud' sign-in sessions from this pool are valid.\nMust be greater than 15 minutes (900s) and less than 12 hours (43200s).\nIf 'sessionDuration' is not configured, minted credentials have a default duration of one hour (3600s).\nA duration in seconds with up to nine fractional digits, ending with ''s''. Example: "'3.5s'". When `null`, the `session_duration` field will be omitted from the resulting object.\n  - `workforce_pool_id` (`string`): The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,\ndigits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.\nThe prefix 'gcp-' is reserved for use by Google, and may not be specified.\n  - `access_restrictions` (`list[obj]`): Configure access restrictions on the workforce pool users. This is an optional field. If specified web\nsign-in can be restricted to given set of services or programmatic sign-in can be disabled for pool users. When `null`, the `access_restrictions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.access_restrictions.new](#fn-access_restrictionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `iam_workforce_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     parent,
     workforce_pool_id,
+    access_restrictions=null,
     description=null,
     disabled=null,
     display_name=null,
     session_duration=null,
     timeouts=null
   ):: std.prune(a={
+    access_restrictions: access_restrictions,
     description: description,
     disabled: disabled,
     display_name: display_name,
@@ -61,6 +83,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAccessRestrictions':: d.fn(help='`google.list[obj].withAccessRestrictions` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the access_restrictions field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAccessRestrictionsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `access_restrictions` field.\n', args=[]),
+  withAccessRestrictions(resourceLabel, value): {
+    resource+: {
+      google_iam_workforce_pool+: {
+        [resourceLabel]+: {
+          access_restrictions: value,
+        },
+      },
+    },
+  },
+  '#withAccessRestrictionsMixin':: d.fn(help='`google.list[obj].withAccessRestrictionsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the access_restrictions field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAccessRestrictions](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `access_restrictions` field.\n', args=[]),
+  withAccessRestrictionsMixin(resourceLabel, value): {
+    resource+: {
+      google_iam_workforce_pool+: {
+        [resourceLabel]+: {
+          access_restrictions+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet b/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet
index fe626fd2..e657d029 100644
--- a/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet
+++ b/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet
@@ -78,16 +78,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
-    '#new':: d.fn(help='\n`google.iam_workforce_pool_provider.oidc.new` constructs a new object with attributes and blocks configured for the `oidc`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_id` (`string`): The client ID. Must match the audience claim of the JWT issued by the identity provider.\n  - `issuer_uri` (`string`): The OIDC issuer URI. Must be a valid URI using the 'https' scheme.\n  - `client_secret` (`list[obj]`): The optional client secret. Required to enable Authorization Code flow for web sign-in. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.client_secret.new](#fn-oidcclient_secretnew) constructor.\n  - `web_sso_config` (`list[obj]`): Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. When `null`, the `web_sso_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.web_sso_config.new](#fn-oidcweb_sso_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oidc` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.iam_workforce_pool_provider.oidc.new` constructs a new object with attributes and blocks configured for the `oidc`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_id` (`string`): The client ID. Must match the audience claim of the JWT issued by the identity provider.\n  - `issuer_uri` (`string`): The OIDC issuer URI. Must be a valid URI using the 'https' scheme.\n  - `jwks_json` (`string`): OIDC JWKs in JSON String format. For details on definition of a\nJWK, see https:tools.ietf.org/html/rfc7517. If not set, then we\nuse the 'jwks_uri' from the discovery document fetched from the\n.well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric\nkeys are supported. The JWK must use following format and include only\nthe following fields:\n'''\n{\n  "keys": [\n    {\n          "kty": "RSA/EC",\n          "alg": "<algorithm>",\n          "use": "sig",\n          "kid": "<key-id>",\n          "n": "",\n          "e": "",\n          "x": "",\n          "y": "",\n          "crv": ""\n    }\n  ]\n}\n''' When `null`, the `jwks_json` field will be omitted from the resulting object.\n  - `client_secret` (`list[obj]`): The optional client secret. Required to enable Authorization Code flow for web sign-in. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.client_secret.new](#fn-oidcclient_secretnew) constructor.\n  - `web_sso_config` (`list[obj]`): Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. When `null`, the `web_sso_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.web_sso_config.new](#fn-oidcweb_sso_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oidc` sub block.\n', args=[]),
     new(
       client_id,
       issuer_uri,
       client_secret=null,
+      jwks_json=null,
       web_sso_config=null
     ):: std.prune(a={
       client_id: client_id,
       client_secret: client_secret,
       issuer_uri: issuer_uri,
+      jwks_json: jwks_json,
       web_sso_config: web_sso_config,
     }),
     web_sso_config:: {
diff --git a/4.x/_gen/resources/iam_workload_identity_pool_provider.libsonnet b/4.x/_gen/resources/iam_workload_identity_pool_provider.libsonnet
index 4a508c1e..67ddb0bb 100644
--- a/4.x/_gen/resources/iam_workload_identity_pool_provider.libsonnet
+++ b/4.x/_gen/resources/iam_workload_identity_pool_provider.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       account_id: account_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.iam_workload_identity_pool_provider.new` injects a new `google_iam_workload_identity_pool_provider` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.iam_workload_identity_pool_provider.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.iam_workload_identity_pool_provider` using the reference:\n\n    $._ref.google_iam_workload_identity_pool_provider.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_iam_workload_identity_pool_provider.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `attribute_condition` (`string`): [A Common Expression Language](https://opensource.google/projects/cel) expression, in\nplain text, to restrict what otherwise valid authentication credentials issued by the\nprovider should not be accepted.\n\nThe expression must output a boolean representing whether to allow the federation.\n\nThe following keywords may be referenced in the expressions:\n  * \u0026#39;assertion\u0026#39;: JSON representing the authentication credential issued by the provider.\n  * \u0026#39;google\u0026#39;: The Google attributes mapped from the assertion in the \u0026#39;attribute_mappings\u0026#39;.\n  * \u0026#39;attribute\u0026#39;: The custom attributes mapped from the assertion in the \u0026#39;attribute_mappings\u0026#39;.\n\nThe maximum length of the attribute condition expression is 4096 characters. If\nunspecified, all valid authentication credential are accepted.\n\nThe following example shows how to only allow credentials with a mapped \u0026#39;google.groups\u0026#39;\nvalue of \u0026#39;admins\u0026#39;:\n\u0026#39;\u0026#39;\u0026#39;\n\u0026#34;\u0026#39;admins\u0026#39; in google.groups\u0026#34;\n\u0026#39;\u0026#39;\u0026#39; When `null`, the `attribute_condition` field will be omitted from the resulting object.\n  - `attribute_mapping` (`obj`): Maps attributes from authentication credentials issued by an external identity provider\nto Google Cloud attributes, such as \u0026#39;subject\u0026#39; and \u0026#39;segment\u0026#39;.\n\nEach key must be a string specifying the Google Cloud IAM attribute to map to.\n\nThe following keys are supported:\n  * \u0026#39;google.subject\u0026#39;: The principal IAM is authenticating. You can reference this value\n    in IAM bindings. This is also the subject that appears in Cloud Logging logs.\n    Cannot exceed 127 characters.\n  * \u0026#39;google.groups\u0026#39;: Groups the external identity belongs to. You can grant groups\n    access to resources using an IAM \u0026#39;principalSet\u0026#39; binding; access applies to all\n    members of the group.\n\nYou can also provide custom attributes by specifying \u0026#39;attribute.{custom_attribute}\u0026#39;,\nwhere \u0026#39;{custom_attribute}\u0026#39; is the name of the custom attribute to be mapped. You can\ndefine a maximum of 50 custom attributes. The maximum length of a mapped attribute key\nis 100 characters, and the key may only contain the characters [a-z0-9_].\n\nYou can reference these attributes in IAM policies to define fine-grained access for a\nworkload to Google Cloud resources. For example:\n  * \u0026#39;google.subject\u0026#39;:\n    \u0026#39;principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}\u0026#39;\n  * \u0026#39;google.groups\u0026#39;:\n    \u0026#39;principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}\u0026#39;\n  * \u0026#39;attribute.{custom_attribute}\u0026#39;:\n    \u0026#39;principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}\u0026#39;\n\nEach value must be a [Common Expression Language](https://opensource.google/projects/cel)\nfunction that maps an identity provider credential to the normalized attribute specified\nby the corresponding map key.\n\nYou can use the \u0026#39;assertion\u0026#39; keyword in the expression to access a JSON representation of\nthe authentication credential issued by the provider.\n\nThe maximum length of an attribute mapping expression is 2048 characters. When evaluated,\nthe total size of all mapped attributes must not exceed 8KB.\n\nFor AWS providers, the following rules apply:\n  - If no attribute mapping is defined, the following default mapping applies:\n    \u0026#39;\u0026#39;\u0026#39;\n    {\n      \u0026#34;google.subject\u0026#34;:\u0026#34;assertion.arn\u0026#34;,\n      \u0026#34;attribute.aws_role\u0026#34;:\n        \u0026#34;assertion.arn.contains(\u0026#39;assumed-role\u0026#39;)\u0026#34;\n        \u0026#34; ? assertion.arn.extract(\u0026#39;{account_arn}assumed-role/\u0026#39;)\u0026#34;\n        \u0026#34;   \u0026#43; \u0026#39;assumed-role/\u0026#39;\u0026#34;\n        \u0026#34;   \u0026#43; assertion.arn.extract(\u0026#39;assumed-role/{role_name}/\u0026#39;)\u0026#34;\n        \u0026#34; : assertion.arn\u0026#34;,\n    }\n    \u0026#39;\u0026#39;\u0026#39;\n  - If any custom attribute mappings are defined, they must include a mapping to the\n    \u0026#39;google.subject\u0026#39; attribute.\n\nFor OIDC providers, the following rules apply:\n  - Custom attribute mappings must be defined, and must include a mapping to the\n    \u0026#39;google.subject\u0026#39; attribute. For example, the following maps the \u0026#39;sub\u0026#39; claim of the\n    incoming credential to the \u0026#39;subject\u0026#39; attribute on a Google token.\n    \u0026#39;\u0026#39;\u0026#39;\n    {\u0026#34;google.subject\u0026#34;: \u0026#34;assertion.sub\u0026#34;}\n    \u0026#39;\u0026#39;\u0026#39; When `null`, the `attribute_mapping` field will be omitted from the resulting object.\n  - `description` (`string`): A description for the provider. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.\nHowever, existing tokens still grant access. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A display name for the provider. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `workload_identity_pool_id` (`string`): The ID used for the pool, which is the final component of the pool resource name. This\nvalue should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n\u0026#39;gcp-\u0026#39; is reserved for use by Google, and may not be specified.\n  - `workload_identity_pool_provider_id` (`string`): The ID for the provider, which becomes the final component of the resource name. This\nvalue must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n\u0026#39;gcp-\u0026#39; is reserved for use by Google, and may not be specified.\n  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.\n  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.iam_workload_identity_pool_provider.new` injects a new `google_iam_workload_identity_pool_provider` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.iam_workload_identity_pool_provider.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.iam_workload_identity_pool_provider` using the reference:\n\n    $._ref.google_iam_workload_identity_pool_provider.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_iam_workload_identity_pool_provider.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `attribute_condition` (`string`): [A Common Expression Language](https://opensource.google/projects/cel) expression, in\nplain text, to restrict what otherwise valid authentication credentials issued by the\nprovider should not be accepted.\n\nThe expression must output a boolean representing whether to allow the federation.\n\nThe following keywords may be referenced in the expressions:\n  * \u0026#39;assertion\u0026#39;: JSON representing the authentication credential issued by the provider.\n  * \u0026#39;google\u0026#39;: The Google attributes mapped from the assertion in the \u0026#39;attribute_mappings\u0026#39;.\n  * \u0026#39;attribute\u0026#39;: The custom attributes mapped from the assertion in the \u0026#39;attribute_mappings\u0026#39;.\n\nThe maximum length of the attribute condition expression is 4096 characters. If\nunspecified, all valid authentication credential are accepted.\n\nThe following example shows how to only allow credentials with a mapped \u0026#39;google.groups\u0026#39;\nvalue of \u0026#39;admins\u0026#39;:\n\u0026#39;\u0026#39;\u0026#39;\n\u0026#34;\u0026#39;admins\u0026#39; in google.groups\u0026#34;\n\u0026#39;\u0026#39;\u0026#39; When `null`, the `attribute_condition` field will be omitted from the resulting object.\n  - `attribute_mapping` (`obj`): Maps attributes from authentication credentials issued by an external identity provider\nto Google Cloud attributes, such as \u0026#39;subject\u0026#39; and \u0026#39;segment\u0026#39;.\n\nEach key must be a string specifying the Google Cloud IAM attribute to map to.\n\nThe following keys are supported:\n  * \u0026#39;google.subject\u0026#39;: The principal IAM is authenticating. You can reference this value\n    in IAM bindings. This is also the subject that appears in Cloud Logging logs.\n    Cannot exceed 127 characters.\n  * \u0026#39;google.groups\u0026#39;: Groups the external identity belongs to. You can grant groups\n    access to resources using an IAM \u0026#39;principalSet\u0026#39; binding; access applies to all\n    members of the group.\n\nYou can also provide custom attributes by specifying \u0026#39;attribute.{custom_attribute}\u0026#39;,\nwhere \u0026#39;{custom_attribute}\u0026#39; is the name of the custom attribute to be mapped. You can\ndefine a maximum of 50 custom attributes. The maximum length of a mapped attribute key\nis 100 characters, and the key may only contain the characters [a-z0-9_].\n\nYou can reference these attributes in IAM policies to define fine-grained access for a\nworkload to Google Cloud resources. For example:\n  * \u0026#39;google.subject\u0026#39;:\n    \u0026#39;principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}\u0026#39;\n  * \u0026#39;google.groups\u0026#39;:\n    \u0026#39;principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}\u0026#39;\n  * \u0026#39;attribute.{custom_attribute}\u0026#39;:\n    \u0026#39;principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}\u0026#39;\n\nEach value must be a [Common Expression Language](https://opensource.google/projects/cel)\nfunction that maps an identity provider credential to the normalized attribute specified\nby the corresponding map key.\n\nYou can use the \u0026#39;assertion\u0026#39; keyword in the expression to access a JSON representation of\nthe authentication credential issued by the provider.\n\nThe maximum length of an attribute mapping expression is 2048 characters. When evaluated,\nthe total size of all mapped attributes must not exceed 8KB.\n\nFor AWS providers, the following rules apply:\n  - If no attribute mapping is defined, the following default mapping applies:\n    \u0026#39;\u0026#39;\u0026#39;\n    {\n      \u0026#34;google.subject\u0026#34;:\u0026#34;assertion.arn\u0026#34;,\n      \u0026#34;attribute.aws_role\u0026#34;:\n        \u0026#34;assertion.arn.contains(\u0026#39;assumed-role\u0026#39;)\u0026#34;\n        \u0026#34; ? assertion.arn.extract(\u0026#39;{account_arn}assumed-role/\u0026#39;)\u0026#34;\n        \u0026#34;   \u0026#43; \u0026#39;assumed-role/\u0026#39;\u0026#34;\n        \u0026#34;   \u0026#43; assertion.arn.extract(\u0026#39;assumed-role/{role_name}/\u0026#39;)\u0026#34;\n        \u0026#34; : assertion.arn\u0026#34;,\n    }\n    \u0026#39;\u0026#39;\u0026#39;\n  - If any custom attribute mappings are defined, they must include a mapping to the\n    \u0026#39;google.subject\u0026#39; attribute.\n\nFor OIDC providers, the following rules apply:\n  - Custom attribute mappings must be defined, and must include a mapping to the\n    \u0026#39;google.subject\u0026#39; attribute. For example, the following maps the \u0026#39;sub\u0026#39; claim of the\n    incoming credential to the \u0026#39;subject\u0026#39; attribute on a Google token.\n    \u0026#39;\u0026#39;\u0026#39;\n    {\u0026#34;google.subject\u0026#34;: \u0026#34;assertion.sub\u0026#34;}\n    \u0026#39;\u0026#39;\u0026#39; When `null`, the `attribute_mapping` field will be omitted from the resulting object.\n  - `description` (`string`): A description for the provider. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.\nHowever, existing tokens still grant access. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A display name for the provider. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `workload_identity_pool_id` (`string`): The ID used for the pool, which is the final component of the pool resource name. This\nvalue should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n\u0026#39;gcp-\u0026#39; is reserved for use by Google, and may not be specified.\n  - `workload_identity_pool_provider_id` (`string`): The ID for the provider, which becomes the final component of the resource name. This\nvalue must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n\u0026#39;gcp-\u0026#39; is reserved for use by Google, and may not be specified.\n  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc or saml. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.\n  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws or saml. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.\n  - `saml` (`list[obj]`): An SAML 2.0 identity provider. Not compatible with the property oidc or aws. When `null`, the `saml` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.saml.new](#fn-samlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     workload_identity_pool_id,
@@ -23,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name=null,
     oidc=null,
     project=null,
+    saml=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -37,13 +38,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       display_name=display_name,
       oidc=oidc,
       project=project,
+      saml=saml,
       timeouts=timeouts,
       workload_identity_pool_id=workload_identity_pool_id,
       workload_identity_pool_provider_id=workload_identity_pool_provider_id
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.iam_workload_identity_pool_provider.newAttrs` constructs a new object with attributes and blocks configured for the `iam_workload_identity_pool_provider`\nTerraform resource.\n\nUnlike [google.iam_workload_identity_pool_provider.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `attribute_condition` (`string`): [A Common Expression Language](https://opensource.google/projects/cel) expression, in\nplain text, to restrict what otherwise valid authentication credentials issued by the\nprovider should not be accepted.\n\nThe expression must output a boolean representing whether to allow the federation.\n\nThe following keywords may be referenced in the expressions:\n  * 'assertion': JSON representing the authentication credential issued by the provider.\n  * 'google': The Google attributes mapped from the assertion in the 'attribute_mappings'.\n  * 'attribute': The custom attributes mapped from the assertion in the 'attribute_mappings'.\n\nThe maximum length of the attribute condition expression is 4096 characters. If\nunspecified, all valid authentication credential are accepted.\n\nThe following example shows how to only allow credentials with a mapped 'google.groups'\nvalue of 'admins':\n'''\n"'admins' in google.groups"\n''' When `null`, the `attribute_condition` field will be omitted from the resulting object.\n  - `attribute_mapping` (`obj`): Maps attributes from authentication credentials issued by an external identity provider\nto Google Cloud attributes, such as 'subject' and 'segment'.\n\nEach key must be a string specifying the Google Cloud IAM attribute to map to.\n\nThe following keys are supported:\n  * 'google.subject': The principal IAM is authenticating. You can reference this value\n    in IAM bindings. This is also the subject that appears in Cloud Logging logs.\n    Cannot exceed 127 characters.\n  * 'google.groups': Groups the external identity belongs to. You can grant groups\n    access to resources using an IAM 'principalSet' binding; access applies to all\n    members of the group.\n\nYou can also provide custom attributes by specifying 'attribute.{custom_attribute}',\nwhere '{custom_attribute}' is the name of the custom attribute to be mapped. You can\ndefine a maximum of 50 custom attributes. The maximum length of a mapped attribute key\nis 100 characters, and the key may only contain the characters [a-z0-9_].\n\nYou can reference these attributes in IAM policies to define fine-grained access for a\nworkload to Google Cloud resources. For example:\n  * 'google.subject':\n    'principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}'\n  * 'google.groups':\n    'principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}'\n  * 'attribute.{custom_attribute}':\n    'principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}'\n\nEach value must be a [Common Expression Language](https://opensource.google/projects/cel)\nfunction that maps an identity provider credential to the normalized attribute specified\nby the corresponding map key.\n\nYou can use the 'assertion' keyword in the expression to access a JSON representation of\nthe authentication credential issued by the provider.\n\nThe maximum length of an attribute mapping expression is 2048 characters. When evaluated,\nthe total size of all mapped attributes must not exceed 8KB.\n\nFor AWS providers, the following rules apply:\n  - If no attribute mapping is defined, the following default mapping applies:\n    '''\n    {\n      "google.subject":"assertion.arn",\n      "attribute.aws_role":\n        "assertion.arn.contains('assumed-role')"\n        " ? assertion.arn.extract('{account_arn}assumed-role/')"\n        "   + 'assumed-role/'"\n        "   + assertion.arn.extract('assumed-role/{role_name}/')"\n        " : assertion.arn",\n    }\n    '''\n  - If any custom attribute mappings are defined, they must include a mapping to the\n    'google.subject' attribute.\n\nFor OIDC providers, the following rules apply:\n  - Custom attribute mappings must be defined, and must include a mapping to the\n    'google.subject' attribute. For example, the following maps the 'sub' claim of the\n    incoming credential to the 'subject' attribute on a Google token.\n    '''\n    {"google.subject": "assertion.sub"}\n    ''' When `null`, the `attribute_mapping` field will be omitted from the resulting object.\n  - `description` (`string`): A description for the provider. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.\nHowever, existing tokens still grant access. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A display name for the provider. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `workload_identity_pool_id` (`string`): The ID used for the pool, which is the final component of the pool resource name. This\nvalue should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n'gcp-' is reserved for use by Google, and may not be specified.\n  - `workload_identity_pool_provider_id` (`string`): The ID for the provider, which becomes the final component of the resource name. This\nvalue must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n'gcp-' is reserved for use by Google, and may not be specified.\n  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.\n  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `iam_workload_identity_pool_provider` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.iam_workload_identity_pool_provider.newAttrs` constructs a new object with attributes and blocks configured for the `iam_workload_identity_pool_provider`\nTerraform resource.\n\nUnlike [google.iam_workload_identity_pool_provider.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `attribute_condition` (`string`): [A Common Expression Language](https://opensource.google/projects/cel) expression, in\nplain text, to restrict what otherwise valid authentication credentials issued by the\nprovider should not be accepted.\n\nThe expression must output a boolean representing whether to allow the federation.\n\nThe following keywords may be referenced in the expressions:\n  * 'assertion': JSON representing the authentication credential issued by the provider.\n  * 'google': The Google attributes mapped from the assertion in the 'attribute_mappings'.\n  * 'attribute': The custom attributes mapped from the assertion in the 'attribute_mappings'.\n\nThe maximum length of the attribute condition expression is 4096 characters. If\nunspecified, all valid authentication credential are accepted.\n\nThe following example shows how to only allow credentials with a mapped 'google.groups'\nvalue of 'admins':\n'''\n"'admins' in google.groups"\n''' When `null`, the `attribute_condition` field will be omitted from the resulting object.\n  - `attribute_mapping` (`obj`): Maps attributes from authentication credentials issued by an external identity provider\nto Google Cloud attributes, such as 'subject' and 'segment'.\n\nEach key must be a string specifying the Google Cloud IAM attribute to map to.\n\nThe following keys are supported:\n  * 'google.subject': The principal IAM is authenticating. You can reference this value\n    in IAM bindings. This is also the subject that appears in Cloud Logging logs.\n    Cannot exceed 127 characters.\n  * 'google.groups': Groups the external identity belongs to. You can grant groups\n    access to resources using an IAM 'principalSet' binding; access applies to all\n    members of the group.\n\nYou can also provide custom attributes by specifying 'attribute.{custom_attribute}',\nwhere '{custom_attribute}' is the name of the custom attribute to be mapped. You can\ndefine a maximum of 50 custom attributes. The maximum length of a mapped attribute key\nis 100 characters, and the key may only contain the characters [a-z0-9_].\n\nYou can reference these attributes in IAM policies to define fine-grained access for a\nworkload to Google Cloud resources. For example:\n  * 'google.subject':\n    'principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}'\n  * 'google.groups':\n    'principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}'\n  * 'attribute.{custom_attribute}':\n    'principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}'\n\nEach value must be a [Common Expression Language](https://opensource.google/projects/cel)\nfunction that maps an identity provider credential to the normalized attribute specified\nby the corresponding map key.\n\nYou can use the 'assertion' keyword in the expression to access a JSON representation of\nthe authentication credential issued by the provider.\n\nThe maximum length of an attribute mapping expression is 2048 characters. When evaluated,\nthe total size of all mapped attributes must not exceed 8KB.\n\nFor AWS providers, the following rules apply:\n  - If no attribute mapping is defined, the following default mapping applies:\n    '''\n    {\n      "google.subject":"assertion.arn",\n      "attribute.aws_role":\n        "assertion.arn.contains('assumed-role')"\n        " ? assertion.arn.extract('{account_arn}assumed-role/')"\n        "   + 'assumed-role/'"\n        "   + assertion.arn.extract('assumed-role/{role_name}/')"\n        " : assertion.arn",\n    }\n    '''\n  - If any custom attribute mappings are defined, they must include a mapping to the\n    'google.subject' attribute.\n\nFor OIDC providers, the following rules apply:\n  - Custom attribute mappings must be defined, and must include a mapping to the\n    'google.subject' attribute. For example, the following maps the 'sub' claim of the\n    incoming credential to the 'subject' attribute on a Google token.\n    '''\n    {"google.subject": "assertion.sub"}\n    ''' When `null`, the `attribute_mapping` field will be omitted from the resulting object.\n  - `description` (`string`): A description for the provider. Cannot exceed 256 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.\nHowever, existing tokens still grant access. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): A display name for the provider. Cannot exceed 32 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `workload_identity_pool_id` (`string`): The ID used for the pool, which is the final component of the pool resource name. This\nvalue should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n'gcp-' is reserved for use by Google, and may not be specified.\n  - `workload_identity_pool_provider_id` (`string`): The ID for the provider, which becomes the final component of the resource name. This\nvalue must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix\n'gcp-' is reserved for use by Google, and may not be specified.\n  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc or saml. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.\n  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws or saml. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.\n  - `saml` (`list[obj]`): An SAML 2.0 identity provider. Not compatible with the property oidc or aws. When `null`, the `saml` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.saml.new](#fn-samlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `iam_workload_identity_pool_provider` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     workload_identity_pool_id,
     workload_identity_pool_provider_id,
@@ -55,6 +57,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name=null,
     oidc=null,
     project=null,
+    saml=null,
     timeouts=null
   ):: std.prune(a={
     attribute_condition: attribute_condition,
@@ -65,6 +68,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name: display_name,
     oidc: oidc,
     project: project,
+    saml: saml,
     timeouts: timeouts,
     workload_identity_pool_id: workload_identity_pool_id,
     workload_identity_pool_provider_id: workload_identity_pool_provider_id,
@@ -81,6 +85,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       jwks_json: jwks_json,
     }),
   },
+  saml:: {
+    '#new':: d.fn(help='\n`google.iam_workload_identity_pool_provider.saml.new` constructs a new object with attributes and blocks configured for the `saml`\nTerraform sub block.\n\n\n\n**Args**:\n  - `idp_metadata_xml` (`string`): SAML Identity provider configuration metadata xml doc.\n\n**Returns**:\n  - An attribute object that represents the `saml` sub block.\n', args=[]),
+    new(
+      idp_metadata_xml
+    ):: std.prune(a={
+      idp_metadata_xml: idp_metadata_xml,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.iam_workload_identity_pool_provider.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -193,6 +205,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSaml':: d.fn(help='`google.list[obj].withSaml` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the saml field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSamlMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `saml` field.\n', args=[]),
+  withSaml(resourceLabel, value): {
+    resource+: {
+      google_iam_workload_identity_pool_provider+: {
+        [resourceLabel]+: {
+          saml: value,
+        },
+      },
+    },
+  },
+  '#withSamlMixin':: d.fn(help='`google.list[obj].withSamlMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the saml field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSaml](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `saml` field.\n', args=[]),
+  withSamlMixin(resourceLabel, value): {
+    resource+: {
+      google_iam_workload_identity_pool_provider+: {
+        [resourceLabel]+: {
+          saml+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/identity_platform_config.libsonnet b/4.x/_gen/resources/identity_platform_config.libsonnet
index bb47898b..2a8445df 100644
--- a/4.x/_gen/resources/identity_platform_config.libsonnet
+++ b/4.x/_gen/resources/identity_platform_config.libsonnet
@@ -34,7 +34,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.identity_platform_config.new` injects a new `google_identity_platform_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.identity_platform_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.identity_platform_config` using the reference:\n\n    $._ref.google_identity_platform_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_identity_platform_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.identity_platform_config.new` injects a new `google_identity_platform_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.identity_platform_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.identity_platform_config` using the reference:\n\n    $._ref.google_identity_platform_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_identity_platform_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     authorized_domains=null,
@@ -43,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     quota=null,
     sign_in=null,
+    sms_region_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -55,11 +56,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       quota=quota,
       sign_in=sign_in,
+      sms_region_config=sms_region_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.identity_platform_config.newAttrs` constructs a new object with attributes and blocks configured for the `identity_platform_config`\nTerraform resource.\n\nUnlike [google.identity_platform_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `identity_platform_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.identity_platform_config.newAttrs` constructs a new object with attributes and blocks configured for the `identity_platform_config`\nTerraform resource.\n\nUnlike [google.identity_platform_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `identity_platform_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     authorized_domains=null,
     autodelete_anonymous_users=null,
@@ -67,6 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     quota=null,
     sign_in=null,
+    sms_region_config=null,
     timeouts=null
   ):: std.prune(a={
     authorized_domains: authorized_domains,
@@ -75,6 +78,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     quota: quota,
     sign_in: sign_in,
+    sms_region_config: sms_region_config,
     timeouts: timeouts,
   }),
   quota:: {
@@ -139,6 +143,32 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
+  sms_region_config:: {
+    allow_by_default:: {
+      '#new':: d.fn(help='\n`google.identity_platform_config.sms_region_config.allow_by_default.new` constructs a new object with attributes and blocks configured for the `allow_by_default`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disallowed_regions` (`list`): Two letter unicode region codes to disallow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `disallowed_regions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `allow_by_default` sub block.\n', args=[]),
+      new(
+        disallowed_regions=null
+      ):: std.prune(a={
+        disallowed_regions: disallowed_regions,
+      }),
+    },
+    allowlist_only:: {
+      '#new':: d.fn(help='\n`google.identity_platform_config.sms_region_config.allowlist_only.new` constructs a new object with attributes and blocks configured for the `allowlist_only`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_regions` (`list`): Two letter unicode region codes to allow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `allowed_regions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `allowlist_only` sub block.\n', args=[]),
+      new(
+        allowed_regions=null
+      ):: std.prune(a={
+        allowed_regions: allowed_regions,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.identity_platform_config.sms_region_config.new` constructs a new object with attributes and blocks configured for the `sms_region_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_by_default` (`list[obj]`): A policy of allowing SMS to every region by default and adding disallowed regions to a disallow list. When `null`, the `allow_by_default` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allow_by_default.new](#fn-sms_region_configallow_by_defaultnew) constructor.\n  - `allowlist_only` (`list[obj]`): A policy of only allowing regions by explicitly adding them to an allowlist. When `null`, the `allowlist_only` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allowlist_only.new](#fn-sms_region_configallowlist_onlynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `sms_region_config` sub block.\n', args=[]),
+    new(
+      allow_by_default=null,
+      allowlist_only=null
+    ):: std.prune(a={
+      allow_by_default: allow_by_default,
+      allowlist_only: allowlist_only,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.identity_platform_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -241,6 +271,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSmsRegionConfig':: d.fn(help='`google.list[obj].withSmsRegionConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the sms_region_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSmsRegionConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.\n', args=[]),
+  withSmsRegionConfig(resourceLabel, value): {
+    resource+: {
+      google_identity_platform_config+: {
+        [resourceLabel]+: {
+          sms_region_config: value,
+        },
+      },
+    },
+  },
+  '#withSmsRegionConfigMixin':: d.fn(help='`google.list[obj].withSmsRegionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the sms_region_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSmsRegionConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.\n', args=[]),
+  withSmsRegionConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_identity_platform_config+: {
+        [resourceLabel]+: {
+          sms_region_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/integration_connectors_connection.libsonnet b/4.x/_gen/resources/integration_connectors_connection.libsonnet
new file mode 100644
index 00000000..ad010e59
--- /dev/null
+++ b/4.x/_gen/resources/integration_connectors_connection.libsonnet
@@ -0,0 +1,872 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='integration_connectors_connection', url='', help='`integration_connectors_connection` represents the `google_integration_connectors_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  auth_config:: {
+    additional_variable:: {
+      encryption_key_value:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected\nformat: projects/*/locations/*/keyRings/*/cryptoKeys/*.\nWill be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"]\n\n**Returns**:\n  - An attribute object that represents the `encryption_key_value` sub block.\n', args=[]),
+        new(
+          type,
+          kms_key_name=null
+        ):: std.prune(a={
+          kms_key_name: kms_key_name,
+          type: type,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.\n  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `key` (`string`): Key for the configVariable\n  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable. When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.additional_variable.encryption_key_value.new](#fn-auth_configauth_configencryption_key_valuenew) constructor.\n  - `secret_value` (`list[obj]`): Secret value of configVariable. When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.additional_variable.secret_value.new](#fn-auth_configauth_configsecret_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `additional_variable` sub block.\n', args=[]),
+      new(
+        key,
+        boolean_value=null,
+        encryption_key_value=null,
+        integer_value=null,
+        secret_value=null,
+        string_value=null
+      ):: std.prune(a={
+        boolean_value: boolean_value,
+        encryption_key_value: encryption_key_value,
+        integer_value: integer_value,
+        key: key,
+        secret_value: secret_value,
+        string_value: string_value,
+      }),
+      secret_value:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `secret_value` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+    },
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.new` constructs a new object with attributes and blocks configured for the `auth_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auth_key` (`string`): The type of authentication configured. When `null`, the `auth_key` field will be omitted from the resulting object.\n  - `auth_type` (`string`): authType of the Connection Possible values: ["USER_PASSWORD", "OAUTH2_JWT_BEARER", "OAUTH2_CLIENT_CREDENTIALS", "SSH_PUBLIC_KEY", "OAUTH2_AUTH_CODE_FLOW"]\n  - `additional_variable` (`list[obj]`): List containing additional auth configs. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.additional_variable.new](#fn-auth_configadditional_variablenew) constructor.\n  - `oauth2_auth_code_flow` (`list[obj]`): Parameters to support Oauth 2.0 Auth Code Grant Authentication. When `null`, the `oauth2_auth_code_flow` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.new](#fn-auth_configoauth2_auth_code_flownew) constructor.\n  - `oauth2_client_credentials` (`list[obj]`): OAuth3 Client Credentials for Authentication. When `null`, the `oauth2_client_credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_client_credentials.new](#fn-auth_configoauth2_client_credentialsnew) constructor.\n  - `oauth2_jwt_bearer` (`list[obj]`): OAuth2 JWT Bearer for Authentication. When `null`, the `oauth2_jwt_bearer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.new](#fn-auth_configoauth2_jwt_bearernew) constructor.\n  - `ssh_public_key` (`list[obj]`): SSH Public Key for Authentication. When `null`, the `ssh_public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.ssh_public_key.new](#fn-auth_configssh_public_keynew) constructor.\n  - `user_password` (`list[obj]`): User password for Authentication. When `null`, the `user_password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.user_password.new](#fn-auth_configuser_passwordnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `auth_config` sub block.\n', args=[]),
+    new(
+      auth_type,
+      additional_variable=null,
+      auth_key=null,
+      oauth2_auth_code_flow=null,
+      oauth2_client_credentials=null,
+      oauth2_jwt_bearer=null,
+      ssh_public_key=null,
+      user_password=null
+    ):: std.prune(a={
+      additional_variable: additional_variable,
+      auth_key: auth_key,
+      auth_type: auth_type,
+      oauth2_auth_code_flow: oauth2_auth_code_flow,
+      oauth2_client_credentials: oauth2_client_credentials,
+      oauth2_jwt_bearer: oauth2_jwt_bearer,
+      ssh_public_key: ssh_public_key,
+      user_password: user_password,
+    }),
+    oauth2_auth_code_flow:: {
+      client_secret:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.client_secret.new` constructs a new object with attributes and blocks configured for the `client_secret`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `client_secret` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.new` constructs a new object with attributes and blocks configured for the `oauth2_auth_code_flow`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auth_uri` (`string`): Auth URL for Authorization Code Flow. When `null`, the `auth_uri` field will be omitted from the resulting object.\n  - `client_id` (`string`): Client ID for user-provided OAuth app. When `null`, the `client_id` field will be omitted from the resulting object.\n  - `enable_pkce` (`bool`): Whether to enable PKCE when the user performs the auth code flow. When `null`, the `enable_pkce` field will be omitted from the resulting object.\n  - `scopes` (`list`): Scopes the connection will request when the user performs the auth code flow. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `client_secret` (`list[obj]`): Client secret for user-provided OAuth app. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.client_secret.new](#fn-auth_configauth_configclient_secretnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oauth2_auth_code_flow` sub block.\n', args=[]),
+      new(
+        auth_uri=null,
+        client_id=null,
+        client_secret=null,
+        enable_pkce=null,
+        scopes=null
+      ):: std.prune(a={
+        auth_uri: auth_uri,
+        client_id: client_id,
+        client_secret: client_secret,
+        enable_pkce: enable_pkce,
+        scopes: scopes,
+      }),
+    },
+    oauth2_client_credentials:: {
+      client_secret:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_client_credentials.client_secret.new` constructs a new object with attributes and blocks configured for the `client_secret`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `client_secret` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_client_credentials.new` constructs a new object with attributes and blocks configured for the `oauth2_client_credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_id` (`string`): Secret version of Password for Authentication.\n  - `client_secret` (`list[obj]`): Secret version reference containing the client secret. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_client_credentials.client_secret.new](#fn-auth_configauth_configclient_secretnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oauth2_client_credentials` sub block.\n', args=[]),
+      new(
+        client_id,
+        client_secret=null
+      ):: std.prune(a={
+        client_id: client_id,
+        client_secret: client_secret,
+      }),
+    },
+    oauth2_jwt_bearer:: {
+      client_key:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.client_key.new` constructs a new object with attributes and blocks configured for the `client_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `client_key` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+      jwt_claims:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.jwt_claims.new` constructs a new object with attributes and blocks configured for the `jwt_claims`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audience` (`string`): Value for the "aud" claim. When `null`, the `audience` field will be omitted from the resulting object.\n  - `issuer` (`string`): Value for the "iss" claim. When `null`, the `issuer` field will be omitted from the resulting object.\n  - `subject` (`string`): Value for the "sub" claim. When `null`, the `subject` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `jwt_claims` sub block.\n', args=[]),
+        new(
+          audience=null,
+          issuer=null,
+          subject=null
+        ):: std.prune(a={
+          audience: audience,
+          issuer: issuer,
+          subject: subject,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.new` constructs a new object with attributes and blocks configured for the `oauth2_jwt_bearer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_key` (`list[obj]`): Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate.\nThis private key will be used to sign JWTs used for the jwt-bearer authorization grant.\nSpecified in the form as: projects/*/secrets/*/versions/*. When `null`, the `client_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.client_key.new](#fn-auth_configauth_configclient_keynew) constructor.\n  - `jwt_claims` (`list[obj]`): JwtClaims providers fields to generate the token. When `null`, the `jwt_claims` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.jwt_claims.new](#fn-auth_configauth_configjwt_claimsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oauth2_jwt_bearer` sub block.\n', args=[]),
+      new(
+        client_key=null,
+        jwt_claims=null
+      ):: std.prune(a={
+        client_key: client_key,
+        jwt_claims: jwt_claims,
+      }),
+    },
+    ssh_public_key:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.ssh_public_key.new` constructs a new object with attributes and blocks configured for the `ssh_public_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cert_type` (`string`): Format of SSH Client cert. When `null`, the `cert_type` field will be omitted from the resulting object.\n  - `username` (`string`): The user account used to authenticate.\n  - `ssh_client_cert` (`list[obj]`): SSH Client Cert. It should contain both public and private key. When `null`, the `ssh_client_cert` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert.new](#fn-auth_configauth_configssh_client_certnew) constructor.\n  - `ssh_client_cert_pass` (`list[obj]`): Password (passphrase) for ssh client certificate if it has one. When `null`, the `ssh_client_cert_pass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert_pass.new](#fn-auth_configauth_configssh_client_cert_passnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ssh_public_key` sub block.\n', args=[]),
+      new(
+        username,
+        cert_type=null,
+        ssh_client_cert=null,
+        ssh_client_cert_pass=null
+      ):: std.prune(a={
+        cert_type: cert_type,
+        ssh_client_cert: ssh_client_cert,
+        ssh_client_cert_pass: ssh_client_cert_pass,
+        username: username,
+      }),
+      ssh_client_cert:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert.new` constructs a new object with attributes and blocks configured for the `ssh_client_cert`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `ssh_client_cert` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+      ssh_client_cert_pass:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert_pass.new` constructs a new object with attributes and blocks configured for the `ssh_client_cert_pass`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `ssh_client_cert_pass` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+    },
+    user_password:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.user_password.new` constructs a new object with attributes and blocks configured for the `user_password`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): Username for Authentication.\n  - `password` (`list[obj]`): Password for Authentication. When `null`, the `password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.user_password.password.new](#fn-auth_configauth_configpasswordnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `user_password` sub block.\n', args=[]),
+      new(
+        username,
+        password=null
+      ):: std.prune(a={
+        password: password,
+        username: username,
+      }),
+      password:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.auth_config.user_password.password.new` constructs a new object with attributes and blocks configured for the `password`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `password` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+    },
+  },
+  config_variable:: {
+    encryption_key_value:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.config_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected\nformat: projects/*/locations/*/keyRings/*/cryptoKeys/*.\nWill be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"]\n\n**Returns**:\n  - An attribute object that represents the `encryption_key_value` sub block.\n', args=[]),
+      new(
+        type,
+        kms_key_name=null
+      ):: std.prune(a={
+        kms_key_name: kms_key_name,
+        type: type,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.config_variable.new` constructs a new object with attributes and blocks configured for the `config_variable`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boolean_value` (`bool`): Boolean Value of configVariable When `null`, the `boolean_value` field will be omitted from the resulting object.\n  - `integer_value` (`number`): Integer Value of configVariable When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `key` (`string`): Key for the configVariable\n  - `string_value` (`string`): String Value of configVariabley When `null`, the `string_value` field will be omitted from the resulting object.\n  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable. When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.encryption_key_value.new](#fn-config_variableencryption_key_valuenew) constructor.\n  - `secret_value` (`list[obj]`): Secret value of configVariable. When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.secret_value.new](#fn-config_variablesecret_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config_variable` sub block.\n', args=[]),
+    new(
+      key,
+      boolean_value=null,
+      encryption_key_value=null,
+      integer_value=null,
+      secret_value=null,
+      string_value=null
+    ):: std.prune(a={
+      boolean_value: boolean_value,
+      encryption_key_value: encryption_key_value,
+      integer_value: integer_value,
+      key: key,
+      secret_value: secret_value,
+      string_value: string_value,
+    }),
+    secret_value:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.config_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `secret_value` sub block.\n', args=[]),
+      new(
+        secret_version
+      ):: std.prune(a={
+        secret_version: secret_version,
+      }),
+    },
+  },
+  destination_config:: {
+    destination:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.destination_config.destination.new` constructs a new object with attributes and blocks configured for the `destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `host` (`string`): For publicly routable host. When `null`, the `host` field will be omitted from the resulting object.\n  - `port` (`number`): The port is the target port number that is accepted by the destination. When `null`, the `port` field will be omitted from the resulting object.\n  - `service_attachment` (`string`): PSC service attachments. Format: projects/*/regions/*/serviceAttachments/* When `null`, the `service_attachment` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `destination` sub block.\n', args=[]),
+      new(
+        host=null,
+        port=null,
+        service_attachment=null
+      ):: std.prune(a={
+        host: host,
+        port: port,
+        service_attachment: service_attachment,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.destination_config.new` constructs a new object with attributes and blocks configured for the `destination_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): The key is the destination identifier that is supported by the Connector.\n  - `destination` (`list[obj]`): The destinations for the key. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.destination_config.destination.new](#fn-destination_configdestinationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `destination_config` sub block.\n', args=[]),
+    new(
+      key,
+      destination=null
+    ):: std.prune(a={
+      destination: destination,
+      key: key,
+    }),
+  },
+  eventing_config:: {
+    additional_variable:: {
+      encryption_key_value:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected\nformat: projects/*/locations/*/keyRings/*/cryptoKeys/*.\nWill be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `type` (`string`): Type of Encryption Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"] When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `encryption_key_value` sub block.\n', args=[]),
+        new(
+          kms_key_name=null,
+          type=null
+        ):: std.prune(a={
+          kms_key_name: kms_key_name,
+          type: type,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.\n  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `key` (`string`): Key for the configVariable\n  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable. When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.additional_variable.encryption_key_value.new](#fn-eventing_configeventing_configencryption_key_valuenew) constructor.\n  - `secret_value` (`list[obj]`): Secret value of configVariable When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.additional_variable.secret_value.new](#fn-eventing_configeventing_configsecret_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `additional_variable` sub block.\n', args=[]),
+      new(
+        key,
+        boolean_value=null,
+        encryption_key_value=null,
+        integer_value=null,
+        secret_value=null,
+        string_value=null
+      ):: std.prune(a={
+        boolean_value: boolean_value,
+        encryption_key_value: encryption_key_value,
+        integer_value: integer_value,
+        key: key,
+        secret_value: secret_value,
+        string_value: string_value,
+      }),
+      secret_value:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `secret_value` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+    },
+    auth_config:: {
+      additional_variable:: {
+        encryption_key_value:: {
+          '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.auth_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected\nformat: projects/*/locations/*/keyRings/*/cryptoKeys/*.\nWill be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"] When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `encryption_key_value` sub block.\n', args=[]),
+          new(
+            kms_key_name=null,
+            type=null
+          ):: std.prune(a={
+            kms_key_name: kms_key_name,
+            type: type,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.auth_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.\n  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `key` (`string`): Key for the configVariable\n  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.additional_variable.encryption_key_value.new](#fn-eventing_configeventing_configauth_configencryption_key_valuenew) constructor.\n  - `secret_value` (`list[obj]`): Secret value of configVariable When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.additional_variable.secret_value.new](#fn-eventing_configeventing_configauth_configsecret_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `additional_variable` sub block.\n', args=[]),
+        new(
+          key,
+          boolean_value=null,
+          encryption_key_value=null,
+          integer_value=null,
+          secret_value=null,
+          string_value=null
+        ):: std.prune(a={
+          boolean_value: boolean_value,
+          encryption_key_value: encryption_key_value,
+          integer_value: integer_value,
+          key: key,
+          secret_value: secret_value,
+          string_value: string_value,
+        }),
+        secret_value:: {
+          '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.auth_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `secret_value` sub block.\n', args=[]),
+          new(
+            secret_version
+          ):: std.prune(a={
+            secret_version: secret_version,
+          }),
+        },
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.auth_config.new` constructs a new object with attributes and blocks configured for the `auth_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auth_key` (`string`): The type of authentication configured. When `null`, the `auth_key` field will be omitted from the resulting object.\n  - `auth_type` (`string`): authType of the Connection Possible values: ["USER_PASSWORD"]\n  - `additional_variable` (`list[obj]`): List containing additional auth configs. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.additional_variable.new](#fn-eventing_configeventing_configadditional_variablenew) constructor.\n  - `user_password` (`list[obj]`): User password for Authentication. When `null`, the `user_password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.user_password.new](#fn-eventing_configeventing_configuser_passwordnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `auth_config` sub block.\n', args=[]),
+      new(
+        auth_type,
+        additional_variable=null,
+        auth_key=null,
+        user_password=null
+      ):: std.prune(a={
+        additional_variable: additional_variable,
+        auth_key: auth_key,
+        auth_type: auth_type,
+        user_password: user_password,
+      }),
+      user_password:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.auth_config.user_password.new` constructs a new object with attributes and blocks configured for the `user_password`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): Username for Authentication. When `null`, the `username` field will be omitted from the resulting object.\n  - `password` (`list[obj]`): Password for Authentication. When `null`, the `password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.user_password.password.new](#fn-eventing_configeventing_configauth_configpasswordnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `user_password` sub block.\n', args=[]),
+        new(
+          password=null,
+          username=null
+        ):: std.prune(a={
+          password: password,
+          username: username,
+        }),
+        password:: {
+          '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.auth_config.user_password.password.new` constructs a new object with attributes and blocks configured for the `password`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): The resource name of the secret version in the format,\nformat as: projects/*/secrets/*/versions/*.\n\n**Returns**:\n  - An attribute object that represents the `password` sub block.\n', args=[]),
+          new(
+            secret_version
+          ):: std.prune(a={
+            secret_version: secret_version,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.new` constructs a new object with attributes and blocks configured for the `eventing_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enrichment_enabled` (`bool`): Enrichment Enabled. When `null`, the `enrichment_enabled` field will be omitted from the resulting object.\n  - `additional_variable` (`list[obj]`): List containing additional auth configs. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.additional_variable.new](#fn-eventing_configadditional_variablenew) constructor.\n  - `auth_config` (`list[obj]`): authConfig for Eventing Configuration. When `null`, the `auth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.new](#fn-eventing_configauth_confignew) constructor.\n  - `registration_destination_config` (`list[obj]`): registrationDestinationConfig When `null`, the `registration_destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.registration_destination_config.new](#fn-eventing_configregistration_destination_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `eventing_config` sub block.\n', args=[]),
+    new(
+      additional_variable=null,
+      auth_config=null,
+      enrichment_enabled=null,
+      registration_destination_config=null
+    ):: std.prune(a={
+      additional_variable: additional_variable,
+      auth_config: auth_config,
+      enrichment_enabled: enrichment_enabled,
+      registration_destination_config: registration_destination_config,
+    }),
+    registration_destination_config:: {
+      destination:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.registration_destination_config.destination.new` constructs a new object with attributes and blocks configured for the `destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `host` (`string`): Host When `null`, the `host` field will be omitted from the resulting object.\n  - `port` (`number`): port number When `null`, the `port` field will be omitted from the resulting object.\n  - `service_attachment` (`string`): Service Attachment When `null`, the `service_attachment` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `destination` sub block.\n', args=[]),
+        new(
+          host=null,
+          port=null,
+          service_attachment=null
+        ):: std.prune(a={
+          host: host,
+          port: port,
+          service_attachment: service_attachment,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.eventing_config.registration_destination_config.new` constructs a new object with attributes and blocks configured for the `registration_destination_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): Key for the connection When `null`, the `key` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): destinations for the connection When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.registration_destination_config.destination.new](#fn-eventing_configeventing_configdestinationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `registration_destination_config` sub block.\n', args=[]),
+      new(
+        destination=null,
+        key=null
+      ):: std.prune(a={
+        destination: destination,
+        key: key,
+      }),
+    },
+  },
+  lock_config:: {
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.lock_config.new` constructs a new object with attributes and blocks configured for the `lock_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `locked` (`bool`): Indicates whether or not the connection is locked.\n  - `reason` (`string`): Describes why a connection is locked. When `null`, the `reason` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `lock_config` sub block.\n', args=[]),
+    new(
+      locked,
+      reason=null
+    ):: std.prune(a={
+      locked: locked,
+      reason: reason,
+    }),
+  },
+  log_config:: {
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.log_config.new` constructs a new object with attributes and blocks configured for the `log_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Enabled represents whether logging is enabled or not for a connection.\n\n**Returns**:\n  - An attribute object that represents the `log_config` sub block.\n', args=[]),
+    new(
+      enabled
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.integration_connectors_connection.new` injects a new `google_integration_connectors_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.integration_connectors_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.integration_connectors_connection` using the reference:\n\n    $._ref.google_integration_connectors_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_integration_connectors_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connector_version` (`string`): connectorVersion of the Connector.\n  - `description` (`string`): An arbitrary description for the Conection. When `null`, the `description` field will be omitted from the resulting object.\n  - `eventing_enablement_type` (`string`): Eventing enablement type. Will be nil if eventing is not enabled. Possible values: [\u0026#34;EVENTING_AND_CONNECTION\u0026#34;, \u0026#34;ONLY_EVENTING\u0026#34;] When `null`, the `eventing_enablement_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location in which Connection needs to be created.\n  - `name` (`string`): Name of Connection needs to be created.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Service account needed for runtime plane to access Google Cloud resources. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `suspended` (`bool`): Suspended indicates if a user has suspended a connection or not. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `auth_config` (`list[obj]`): authConfig for the connection. When `null`, the `auth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.new](#fn-auth_confignew) constructor.\n  - `config_variable` (`list[obj]`): Config Variables for the connection. When `null`, the `config_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.new](#fn-config_variablenew) constructor.\n  - `destination_config` (`list[obj]`): Define the Connectors target endpoint. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.destination_config.new](#fn-destination_confignew) constructor.\n  - `eventing_config` (`list[obj]`): Eventing Configuration of a connection When `null`, the `eventing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.new](#fn-eventing_confignew) constructor.\n  - `lock_config` (`list[obj]`): Determines whether or no a connection is locked. If locked, a reason must be specified. When `null`, the `lock_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.lock_config.new](#fn-lock_confignew) constructor.\n  - `log_config` (`list[obj]`): Log configuration for the connection. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.log_config.new](#fn-log_confignew) constructor.\n  - `node_config` (`list[obj]`): Node configuration for the connection. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.node_config.new](#fn-node_confignew) constructor.\n  - `ssl_config` (`list[obj]`): SSL Configuration of a connection When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.new](#fn-ssl_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    connector_version,
+    location,
+    name,
+    auth_config=null,
+    config_variable=null,
+    description=null,
+    destination_config=null,
+    eventing_config=null,
+    eventing_enablement_type=null,
+    labels=null,
+    lock_config=null,
+    log_config=null,
+    node_config=null,
+    project=null,
+    service_account=null,
+    ssl_config=null,
+    suspended=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_integration_connectors_connection',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      auth_config=auth_config,
+      config_variable=config_variable,
+      connector_version=connector_version,
+      description=description,
+      destination_config=destination_config,
+      eventing_config=eventing_config,
+      eventing_enablement_type=eventing_enablement_type,
+      labels=labels,
+      location=location,
+      lock_config=lock_config,
+      log_config=log_config,
+      name=name,
+      node_config=node_config,
+      project=project,
+      service_account=service_account,
+      ssl_config=ssl_config,
+      suspended=suspended,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.integration_connectors_connection.newAttrs` constructs a new object with attributes and blocks configured for the `integration_connectors_connection`\nTerraform resource.\n\nUnlike [google.integration_connectors_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connector_version` (`string`): connectorVersion of the Connector.\n  - `description` (`string`): An arbitrary description for the Conection. When `null`, the `description` field will be omitted from the resulting object.\n  - `eventing_enablement_type` (`string`): Eventing enablement type. Will be nil if eventing is not enabled. Possible values: ["EVENTING_AND_CONNECTION", "ONLY_EVENTING"] When `null`, the `eventing_enablement_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location in which Connection needs to be created.\n  - `name` (`string`): Name of Connection needs to be created.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Service account needed for runtime plane to access Google Cloud resources. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `suspended` (`bool`): Suspended indicates if a user has suspended a connection or not. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `auth_config` (`list[obj]`): authConfig for the connection. When `null`, the `auth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.new](#fn-auth_confignew) constructor.\n  - `config_variable` (`list[obj]`): Config Variables for the connection. When `null`, the `config_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.new](#fn-config_variablenew) constructor.\n  - `destination_config` (`list[obj]`): Define the Connectors target endpoint. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.destination_config.new](#fn-destination_confignew) constructor.\n  - `eventing_config` (`list[obj]`): Eventing Configuration of a connection When `null`, the `eventing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.new](#fn-eventing_confignew) constructor.\n  - `lock_config` (`list[obj]`): Determines whether or no a connection is locked. If locked, a reason must be specified. When `null`, the `lock_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.lock_config.new](#fn-lock_confignew) constructor.\n  - `log_config` (`list[obj]`): Log configuration for the connection. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.log_config.new](#fn-log_confignew) constructor.\n  - `node_config` (`list[obj]`): Node configuration for the connection. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.node_config.new](#fn-node_confignew) constructor.\n  - `ssl_config` (`list[obj]`): SSL Configuration of a connection When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.new](#fn-ssl_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `integration_connectors_connection` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    connector_version,
+    location,
+    name,
+    auth_config=null,
+    config_variable=null,
+    description=null,
+    destination_config=null,
+    eventing_config=null,
+    eventing_enablement_type=null,
+    labels=null,
+    lock_config=null,
+    log_config=null,
+    node_config=null,
+    project=null,
+    service_account=null,
+    ssl_config=null,
+    suspended=null,
+    timeouts=null
+  ):: std.prune(a={
+    auth_config: auth_config,
+    config_variable: config_variable,
+    connector_version: connector_version,
+    description: description,
+    destination_config: destination_config,
+    eventing_config: eventing_config,
+    eventing_enablement_type: eventing_enablement_type,
+    labels: labels,
+    location: location,
+    lock_config: lock_config,
+    log_config: log_config,
+    name: name,
+    node_config: node_config,
+    project: project,
+    service_account: service_account,
+    ssl_config: ssl_config,
+    suspended: suspended,
+    timeouts: timeouts,
+  }),
+  node_config:: {
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_node_count` (`number`): Minimum number of nodes in the runtime nodes. When `null`, the `max_node_count` field will be omitted from the resulting object.\n  - `min_node_count` (`number`): Minimum number of nodes in the runtime nodes. When `null`, the `min_node_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      max_node_count=null,
+      min_node_count=null
+    ):: std.prune(a={
+      max_node_count: max_node_count,
+      min_node_count: min_node_count,
+    }),
+  },
+  ssl_config:: {
+    additional_variable:: {
+      encryption_key_value:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected\nformat: projects/*/locations/*/keyRings/*/cryptoKeys/*.\nWill be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"] When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `encryption_key_value` sub block.\n', args=[]),
+        new(
+          kms_key_name=null,
+          type=null
+        ):: std.prune(a={
+          kms_key_name: kms_key_name,
+          type: type,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.\n  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `key` (`string`): Key for the configVariable\n  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.additional_variable.encryption_key_value.new](#fn-ssl_configssl_configencryption_key_valuenew) constructor.\n  - `secret_value` (`list[obj]`): Secret value of configVariable When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.additional_variable.secret_value.new](#fn-ssl_configssl_configsecret_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `additional_variable` sub block.\n', args=[]),
+      new(
+        key,
+        boolean_value=null,
+        encryption_key_value=null,
+        integer_value=null,
+        secret_value=null,
+        string_value=null
+      ):: std.prune(a={
+        boolean_value: boolean_value,
+        encryption_key_value: encryption_key_value,
+        integer_value: integer_value,
+        key: key,
+        secret_value: secret_value,
+        string_value: string_value,
+      }),
+      secret_value:: {
+        '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `secret_value` sub block.\n', args=[]),
+        new(
+          secret_version
+        ):: std.prune(a={
+          secret_version: secret_version,
+        }),
+      },
+    },
+    client_certificate:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.client_certificate.new` constructs a new object with attributes and blocks configured for the `client_certificate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `client_certificate` sub block.\n', args=[]),
+      new(
+        secret_version
+      ):: std.prune(a={
+        secret_version: secret_version,
+      }),
+    },
+    client_private_key:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.client_private_key.new` constructs a new object with attributes and blocks configured for the `client_private_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `client_private_key` sub block.\n', args=[]),
+      new(
+        secret_version
+      ):: std.prune(a={
+        secret_version: secret_version,
+      }),
+    },
+    client_private_key_pass:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.client_private_key_pass.new` constructs a new object with attributes and blocks configured for the `client_private_key_pass`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `client_private_key_pass` sub block.\n', args=[]),
+      new(
+        secret_version
+      ):: std.prune(a={
+        secret_version: secret_version,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.new` constructs a new object with attributes and blocks configured for the `ssl_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_cert_type` (`string`): Type of Client Cert (PEM/JKS/.. etc.) Possible values: ["PEM"] When `null`, the `client_cert_type` field will be omitted from the resulting object.\n  - `server_cert_type` (`string`): Type of Server Cert (PEM/JKS/.. etc.) Possible values: ["PEM"] When `null`, the `server_cert_type` field will be omitted from the resulting object.\n  - `trust_model` (`string`): Enum for Trust Model Possible values: ["PUBLIC", "PRIVATE", "INSECURE"] When `null`, the `trust_model` field will be omitted from the resulting object.\n  - `type` (`string`): Enum for controlling the SSL Type (TLS/MTLS) Possible values: ["TLS", "MTLS"]\n  - `use_ssl` (`bool`): Bool for enabling SSL When `null`, the `use_ssl` field will be omitted from the resulting object.\n  - `additional_variable` (`list[obj]`): Additional SSL related field values. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.additional_variable.new](#fn-ssl_configadditional_variablenew) constructor.\n  - `client_certificate` (`list[obj]`): Client Certificate When `null`, the `client_certificate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.client_certificate.new](#fn-ssl_configclient_certificatenew) constructor.\n  - `client_private_key` (`list[obj]`): Client Private Key When `null`, the `client_private_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.client_private_key.new](#fn-ssl_configclient_private_keynew) constructor.\n  - `client_private_key_pass` (`list[obj]`): Secret containing the passphrase protecting the Client Private Key When `null`, the `client_private_key_pass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.client_private_key_pass.new](#fn-ssl_configclient_private_key_passnew) constructor.\n  - `private_server_certificate` (`list[obj]`): Private Server Certificate. Needs to be specified if trust model is PRIVATE. When `null`, the `private_server_certificate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.private_server_certificate.new](#fn-ssl_configprivate_server_certificatenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ssl_config` sub block.\n', args=[]),
+    new(
+      type,
+      additional_variable=null,
+      client_cert_type=null,
+      client_certificate=null,
+      client_private_key=null,
+      client_private_key_pass=null,
+      private_server_certificate=null,
+      server_cert_type=null,
+      trust_model=null,
+      use_ssl=null
+    ):: std.prune(a={
+      additional_variable: additional_variable,
+      client_cert_type: client_cert_type,
+      client_certificate: client_certificate,
+      client_private_key: client_private_key,
+      client_private_key_pass: client_private_key_pass,
+      private_server_certificate: private_server_certificate,
+      server_cert_type: server_cert_type,
+      trust_model: trust_model,
+      type: type,
+      use_ssl: use_ssl,
+    }),
+    private_server_certificate:: {
+      '#new':: d.fn(help='\n`google.integration_connectors_connection.ssl_config.private_server_certificate.new` constructs a new object with attributes and blocks configured for the `private_server_certificate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `secret_version` (`string`): Secret version of Secret Value for Config variable.\n\n**Returns**:\n  - An attribute object that represents the `private_server_certificate` sub block.\n', args=[]),
+      new(
+        secret_version
+      ):: std.prune(a={
+        secret_version: secret_version,
+      }),
+    },
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.integration_connectors_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAuthConfig':: d.fn(help='`google.list[obj].withAuthConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the auth_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAuthConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `auth_config` field.\n', args=[]),
+  withAuthConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          auth_config: value,
+        },
+      },
+    },
+  },
+  '#withAuthConfigMixin':: d.fn(help='`google.list[obj].withAuthConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the auth_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAuthConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `auth_config` field.\n', args=[]),
+  withAuthConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          auth_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withConfigVariable':: d.fn(help='`google.list[obj].withConfigVariable` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the config_variable field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConfigVariableMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `config_variable` field.\n', args=[]),
+  withConfigVariable(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          config_variable: value,
+        },
+      },
+    },
+  },
+  '#withConfigVariableMixin':: d.fn(help='`google.list[obj].withConfigVariableMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the config_variable field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withConfigVariable](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `config_variable` field.\n', args=[]),
+  withConfigVariableMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          config_variable+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withConnectorVersion':: d.fn(help='`google.string.withConnectorVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the connector_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `connector_version` field.\n', args=[]),
+  withConnectorVersion(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          connector_version: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDestinationConfig':: d.fn(help='`google.list[obj].withDestinationConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the destination_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDestinationConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `destination_config` field.\n', args=[]),
+  withDestinationConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          destination_config: value,
+        },
+      },
+    },
+  },
+  '#withDestinationConfigMixin':: d.fn(help='`google.list[obj].withDestinationConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the destination_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDestinationConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `destination_config` field.\n', args=[]),
+  withDestinationConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          destination_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withEventingConfig':: d.fn(help='`google.list[obj].withEventingConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the eventing_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEventingConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `eventing_config` field.\n', args=[]),
+  withEventingConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          eventing_config: value,
+        },
+      },
+    },
+  },
+  '#withEventingConfigMixin':: d.fn(help='`google.list[obj].withEventingConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the eventing_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEventingConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `eventing_config` field.\n', args=[]),
+  withEventingConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          eventing_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withEventingEnablementType':: d.fn(help='`google.string.withEventingEnablementType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the eventing_enablement_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `eventing_enablement_type` field.\n', args=[]),
+  withEventingEnablementType(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          eventing_enablement_type: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withLockConfig':: d.fn(help='`google.list[obj].withLockConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the lock_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLockConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `lock_config` field.\n', args=[]),
+  withLockConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          lock_config: value,
+        },
+      },
+    },
+  },
+  '#withLockConfigMixin':: d.fn(help='`google.list[obj].withLockConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the lock_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLockConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `lock_config` field.\n', args=[]),
+  withLockConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          lock_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLogConfig':: d.fn(help='`google.list[obj].withLogConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the log_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLogConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `log_config` field.\n', args=[]),
+  withLogConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          log_config: value,
+        },
+      },
+    },
+  },
+  '#withLogConfigMixin':: d.fn(help='`google.list[obj].withLogConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the log_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLogConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `log_config` field.\n', args=[]),
+  withLogConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          log_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withServiceAccount':: d.fn(help='`google.string.withServiceAccount` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_account field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_account` field.\n', args=[]),
+  withServiceAccount(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          service_account: value,
+        },
+      },
+    },
+  },
+  '#withSslConfig':: d.fn(help='`google.list[obj].withSslConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ssl_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSslConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ssl_config` field.\n', args=[]),
+  withSslConfig(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          ssl_config: value,
+        },
+      },
+    },
+  },
+  '#withSslConfigMixin':: d.fn(help='`google.list[obj].withSslConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ssl_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSslConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ssl_config` field.\n', args=[]),
+  withSslConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          ssl_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withSuspended':: d.fn(help='`google.bool.withSuspended` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the suspended field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `suspended` field.\n', args=[]),
+  withSuspended(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          suspended: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_connection+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/integration_connectors_endpoint_attachment.libsonnet b/4.x/_gen/resources/integration_connectors_endpoint_attachment.libsonnet
new file mode 100644
index 00000000..1c9a0dc9
--- /dev/null
+++ b/4.x/_gen/resources/integration_connectors_endpoint_attachment.libsonnet
@@ -0,0 +1,140 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='integration_connectors_endpoint_attachment', url='', help='`integration_connectors_endpoint_attachment` represents the `google_integration_connectors_endpoint_attachment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.integration_connectors_endpoint_attachment.new` injects a new `google_integration_connectors_endpoint_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.integration_connectors_endpoint_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.integration_connectors_endpoint_attachment` using the reference:\n\n    $._ref.google_integration_connectors_endpoint_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_integration_connectors_endpoint_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location in which Endpoint Attachment needs to be created.\n  - `name` (`string`): Name of Endpoint Attachment needs to be created.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_attachment` (`string`): The path of the service attachment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_endpoint_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    service_attachment,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_integration_connectors_endpoint_attachment',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      labels=labels,
+      location=location,
+      name=name,
+      project=project,
+      service_attachment=service_attachment,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.integration_connectors_endpoint_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `integration_connectors_endpoint_attachment`\nTerraform resource.\n\nUnlike [google.integration_connectors_endpoint_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location in which Endpoint Attachment needs to be created.\n  - `name` (`string`): Name of Endpoint Attachment needs to be created.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_attachment` (`string`): The path of the service attachment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_endpoint_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `integration_connectors_endpoint_attachment` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    service_attachment,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    labels: labels,
+    location: location,
+    name: name,
+    project: project,
+    service_attachment: service_attachment,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.integration_connectors_endpoint_attachment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withServiceAttachment':: d.fn(help='`google.string.withServiceAttachment` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_attachment field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_attachment` field.\n', args=[]),
+  withServiceAttachment(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          service_attachment: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_integration_connectors_endpoint_attachment+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/kms_crypto_key.libsonnet b/4.x/_gen/resources/kms_crypto_key.libsonnet
index 8dc923b1..c35ca787 100644
--- a/4.x/_gen/resources/kms_crypto_key.libsonnet
+++ b/4.x/_gen/resources/kms_crypto_key.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='kms_crypto_key', url='', help='`kms_crypto_key` represents the `google_kms_crypto_key` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.kms_crypto_key.new` injects a new `google_kms_crypto_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.kms_crypto_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.kms_crypto_key` using the reference:\n\n    $._ref.google_kms_crypto_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_kms_crypto_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: \u0026#39;\u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}\u0026#39;\u0026#39;.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is \u0026#34;ENCRYPT_DECRYPT\u0026#34;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter \u0026#39;s\u0026#39; (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the \u0026#39;google_kms_key_ring_import_job\u0026#39; resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.kms_crypto_key.new` injects a new `google_kms_crypto_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.kms_crypto_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.kms_crypto_key` using the reference:\n\n    $._ref.google_kms_crypto_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_kms_crypto_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: \u0026#39;\u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}\u0026#39;\u0026#39;.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is \u0026#34;ENCRYPT_DECRYPT\u0026#34;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter \u0026#39;s\u0026#39; (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the \u0026#39;google_kms_key_ring_import_job\u0026#39; resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     key_ring,
@@ -33,7 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.kms_crypto_key.newAttrs` constructs a new object with attributes and blocks configured for the `kms_crypto_key`\nTerraform resource.\n\nUnlike [google.kms_crypto_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter 's' (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the 'google_kms_key_ring_import_job' resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kms_crypto_key` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.kms_crypto_key.newAttrs` constructs a new object with attributes and blocks configured for the `kms_crypto_key`\nTerraform resource.\n\nUnlike [google.kms_crypto_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter 's' (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the 'google_kms_key_ring_import_job' resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kms_crypto_key` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     key_ring,
     name,
diff --git a/4.x/_gen/resources/logging_billing_account_bucket_config.libsonnet b/4.x/_gen/resources/logging_billing_account_bucket_config.libsonnet
index 376c36cd..44cae7cc 100644
--- a/4.x/_gen/resources/logging_billing_account_bucket_config.libsonnet
+++ b/4.x/_gen/resources/logging_billing_account_bucket_config.libsonnet
@@ -10,7 +10,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.logging_billing_account_bucket_config.new` injects a new `google_logging_billing_account_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_billing_account_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_billing_account_bucket_config` using the reference:\n\n    $._ref.google_logging_billing_account_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_billing_account_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): The parent resource that contains the logging bucket.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  index_configs:: {
+    '#new':: d.fn(help='\n`google.logging_billing_account_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `field_path` (`string`): The LogEntry field path to index.\n  - `type` (`string`): The type of data in this index\nNote that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.\nFor example: jsonPayload.request.status\n\n**Returns**:\n  - An attribute object that represents the `index_configs` sub block.\n', args=[]),
+    new(
+      field_path,
+      type
+    ):: std.prune(a={
+      field_path: field_path,
+      type: type,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.logging_billing_account_bucket_config.new` injects a new `google_logging_billing_account_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_billing_account_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_billing_account_bucket_config` using the reference:\n\n    $._ref.google_logging_billing_account_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_billing_account_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): The parent resource that contains the logging bucket.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     billing_account,
@@ -18,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     location,
     cmek_settings=null,
     description=null,
+    index_configs=null,
     retention_days=null,
     _meta={}
   ):: tf.withResource(
@@ -28,24 +39,27 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       bucket_id=bucket_id,
       cmek_settings=cmek_settings,
       description=description,
+      index_configs=index_configs,
       location=location,
       retention_days=retention_days
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.logging_billing_account_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_billing_account_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_billing_account_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): The parent resource that contains the logging bucket.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_billing_account_bucket_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.logging_billing_account_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_billing_account_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_billing_account_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): The parent resource that contains the logging bucket.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_billing_account_bucket_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     billing_account,
     bucket_id,
     location,
     cmek_settings=null,
     description=null,
+    index_configs=null,
     retention_days=null
   ):: std.prune(a={
     billing_account: billing_account,
     bucket_id: bucket_id,
     cmek_settings: cmek_settings,
     description: description,
+    index_configs: index_configs,
     location: location,
     retention_days: retention_days,
   }),
@@ -99,6 +113,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIndexConfigs':: d.fn(help='`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigs(resourceLabel, value): {
+    resource+: {
+      google_logging_billing_account_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs: value,
+        },
+      },
+    },
+  },
+  '#withIndexConfigsMixin':: d.fn(help='`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_logging_billing_account_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/logging_folder_bucket_config.libsonnet b/4.x/_gen/resources/logging_folder_bucket_config.libsonnet
index 0764221f..6ceef933 100644
--- a/4.x/_gen/resources/logging_folder_bucket_config.libsonnet
+++ b/4.x/_gen/resources/logging_folder_bucket_config.libsonnet
@@ -10,7 +10,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.logging_folder_bucket_config.new` injects a new `google_logging_folder_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_folder_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_folder_bucket_config` using the reference:\n\n    $._ref.google_logging_folder_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_folder_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `folder` (`string`): The parent resource that contains the logging bucket.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  index_configs:: {
+    '#new':: d.fn(help='\n`google.logging_folder_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `field_path` (`string`): The LogEntry field path to index.\n  - `type` (`string`): The type of data in this index\nNote that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.\nFor example: jsonPayload.request.status\n\n**Returns**:\n  - An attribute object that represents the `index_configs` sub block.\n', args=[]),
+    new(
+      field_path,
+      type
+    ):: std.prune(a={
+      field_path: field_path,
+      type: type,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.logging_folder_bucket_config.new` injects a new `google_logging_folder_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_folder_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_folder_bucket_config` using the reference:\n\n    $._ref.google_logging_folder_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_folder_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `folder` (`string`): The parent resource that contains the logging bucket.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     bucket_id,
@@ -18,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     location,
     cmek_settings=null,
     description=null,
+    index_configs=null,
     retention_days=null,
     _meta={}
   ):: tf.withResource(
@@ -28,24 +39,27 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cmek_settings=cmek_settings,
       description=description,
       folder=folder,
+      index_configs=index_configs,
       location=location,
       retention_days=retention_days
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.logging_folder_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_folder_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_folder_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `folder` (`string`): The parent resource that contains the logging bucket.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_folder_bucket_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.logging_folder_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_folder_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_folder_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `folder` (`string`): The parent resource that contains the logging bucket.\n  - `location` (`string`): The location of the bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_folder_bucket_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     bucket_id,
     folder,
     location,
     cmek_settings=null,
     description=null,
+    index_configs=null,
     retention_days=null
   ):: std.prune(a={
     bucket_id: bucket_id,
     cmek_settings: cmek_settings,
     description: description,
     folder: folder,
+    index_configs: index_configs,
     location: location,
     retention_days: retention_days,
   }),
@@ -99,6 +113,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIndexConfigs':: d.fn(help='`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigs(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs: value,
+        },
+      },
+    },
+  },
+  '#withIndexConfigsMixin':: d.fn(help='`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/logging_folder_settings.libsonnet b/4.x/_gen/resources/logging_folder_settings.libsonnet
new file mode 100644
index 00000000..01a7fb9f
--- /dev/null
+++ b/4.x/_gen/resources/logging_folder_settings.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='logging_folder_settings', url='', help='`logging_folder_settings` represents the `google_logging_folder_settings` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.logging_folder_settings.new` injects a new `google_logging_folder_settings` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_folder_settings.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_folder_settings` using the reference:\n\n    $._ref.google_logging_folder_settings.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_folder_settings.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.\n  - `folder` (`string`): The folder for which to retrieve settings.\n  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_settings.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    folder,
+    disable_default_sink=null,
+    kms_key_name=null,
+    storage_location=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_logging_folder_settings',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      disable_default_sink=disable_default_sink,
+      folder=folder,
+      kms_key_name=kms_key_name,
+      storage_location=storage_location,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.logging_folder_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_folder_settings`\nTerraform resource.\n\nUnlike [google.logging_folder_settings.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.\n  - `folder` (`string`): The folder for which to retrieve settings.\n  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_settings.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_folder_settings` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    folder,
+    disable_default_sink=null,
+    kms_key_name=null,
+    storage_location=null,
+    timeouts=null
+  ):: std.prune(a={
+    disable_default_sink: disable_default_sink,
+    folder: folder,
+    kms_key_name: kms_key_name,
+    storage_location: storage_location,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.logging_folder_settings.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDisableDefaultSink':: d.fn(help='`google.bool.withDisableDefaultSink` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the disable_default_sink field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `disable_default_sink` field.\n', args=[]),
+  withDisableDefaultSink(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_settings+: {
+        [resourceLabel]+: {
+          disable_default_sink: value,
+        },
+      },
+    },
+  },
+  '#withFolder':: d.fn(help='`google.string.withFolder` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the folder field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `folder` field.\n', args=[]),
+  withFolder(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_settings+: {
+        [resourceLabel]+: {
+          folder: value,
+        },
+      },
+    },
+  },
+  '#withKmsKeyName':: d.fn(help='`google.string.withKmsKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kms_key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kms_key_name` field.\n', args=[]),
+  withKmsKeyName(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_settings+: {
+        [resourceLabel]+: {
+          kms_key_name: value,
+        },
+      },
+    },
+  },
+  '#withStorageLocation':: d.fn(help='`google.string.withStorageLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the storage_location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `storage_location` field.\n', args=[]),
+  withStorageLocation(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_settings+: {
+        [resourceLabel]+: {
+          storage_location: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_settings+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_logging_folder_settings+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/logging_metric.libsonnet b/4.x/_gen/resources/logging_metric.libsonnet
index a4a9b53b..a4071591 100644
--- a/4.x/_gen/resources/logging_metric.libsonnet
+++ b/4.x/_gen/resources/logging_metric.libsonnet
@@ -12,11 +12,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     exponential_buckets:: {
-      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.exponential_buckets.new` constructs a new object with attributes and blocks configured for the `exponential_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `growth_factor` (`number`): Must be greater than 1. When `null`, the `growth_factor` field will be omitted from the resulting object.\n  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.\n  - `scale` (`number`): Must be greater than 0. When `null`, the `scale` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `exponential_buckets` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.exponential_buckets.new` constructs a new object with attributes and blocks configured for the `exponential_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `growth_factor` (`number`): Must be greater than 1.\n  - `num_finite_buckets` (`number`): Must be greater than 0.\n  - `scale` (`number`): Must be greater than 0.\n\n**Returns**:\n  - An attribute object that represents the `exponential_buckets` sub block.\n', args=[]),
       new(
-        growth_factor=null,
-        num_finite_buckets=null,
-        scale=null
+        growth_factor,
+        num_finite_buckets,
+        scale
       ):: std.prune(a={
         growth_factor: growth_factor,
         num_finite_buckets: num_finite_buckets,
@@ -24,11 +24,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     linear_buckets:: {
-      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.linear_buckets.new` constructs a new object with attributes and blocks configured for the `linear_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.\n  - `offset` (`number`): Lower bound of the first bucket. When `null`, the `offset` field will be omitted from the resulting object.\n  - `width` (`number`): Must be greater than 0. When `null`, the `width` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linear_buckets` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.linear_buckets.new` constructs a new object with attributes and blocks configured for the `linear_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_finite_buckets` (`number`): Must be greater than 0.\n  - `offset` (`number`): Lower bound of the first bucket.\n  - `width` (`number`): Must be greater than 0.\n\n**Returns**:\n  - An attribute object that represents the `linear_buckets` sub block.\n', args=[]),
       new(
-        num_finite_buckets=null,
-        offset=null,
-        width=null
+        num_finite_buckets,
+        offset,
+        width
       ):: std.prune(a={
         num_finite_buckets: num_finite_buckets,
         offset: offset,
diff --git a/4.x/_gen/resources/logging_organization_bucket_config.libsonnet b/4.x/_gen/resources/logging_organization_bucket_config.libsonnet
index 7485db52..a9f3062f 100644
--- a/4.x/_gen/resources/logging_organization_bucket_config.libsonnet
+++ b/4.x/_gen/resources/logging_organization_bucket_config.libsonnet
@@ -10,7 +10,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.logging_organization_bucket_config.new` injects a new `google_logging_organization_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_organization_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_organization_bucket_config` using the reference:\n\n    $._ref.google_logging_organization_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_organization_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `organization` (`string`): The parent resource that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  index_configs:: {
+    '#new':: d.fn(help='\n`google.logging_organization_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `field_path` (`string`): The LogEntry field path to index.\n  - `type` (`string`): The type of data in this index\nNote that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.\nFor example: jsonPayload.request.status\n\n**Returns**:\n  - An attribute object that represents the `index_configs` sub block.\n', args=[]),
+    new(
+      field_path,
+      type
+    ):: std.prune(a={
+      field_path: field_path,
+      type: type,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.logging_organization_bucket_config.new` injects a new `google_logging_organization_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_organization_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_organization_bucket_config` using the reference:\n\n    $._ref.google_logging_organization_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_organization_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `organization` (`string`): The parent resource that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     bucket_id,
@@ -18,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     organization,
     cmek_settings=null,
     description=null,
+    index_configs=null,
     retention_days=null,
     _meta={}
   ):: tf.withResource(
@@ -27,24 +38,27 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       bucket_id=bucket_id,
       cmek_settings=cmek_settings,
       description=description,
+      index_configs=index_configs,
       location=location,
       organization=organization,
       retention_days=retention_days
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.logging_organization_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_organization_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_organization_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `organization` (`string`): The parent resource that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_organization_bucket_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.logging_organization_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_organization_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_organization_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `organization` (`string`): The parent resource that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_organization_bucket_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     bucket_id,
     location,
     organization,
     cmek_settings=null,
     description=null,
+    index_configs=null,
     retention_days=null
   ):: std.prune(a={
     bucket_id: bucket_id,
     cmek_settings: cmek_settings,
     description: description,
+    index_configs: index_configs,
     location: location,
     organization: organization,
     retention_days: retention_days,
@@ -89,6 +103,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIndexConfigs':: d.fn(help='`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigs(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs: value,
+        },
+      },
+    },
+  },
+  '#withIndexConfigsMixin':: d.fn(help='`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/logging_organization_settings.libsonnet b/4.x/_gen/resources/logging_organization_settings.libsonnet
new file mode 100644
index 00000000..6c02dd71
--- /dev/null
+++ b/4.x/_gen/resources/logging_organization_settings.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='logging_organization_settings', url='', help='`logging_organization_settings` represents the `google_logging_organization_settings` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.logging_organization_settings.new` injects a new `google_logging_organization_settings` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_organization_settings.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_organization_settings` using the reference:\n\n    $._ref.google_logging_organization_settings.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_organization_settings.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization for which to retrieve or configure settings.\n  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_settings.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    organization,
+    disable_default_sink=null,
+    kms_key_name=null,
+    storage_location=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_logging_organization_settings',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      disable_default_sink=disable_default_sink,
+      kms_key_name=kms_key_name,
+      organization=organization,
+      storage_location=storage_location,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.logging_organization_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_organization_settings`\nTerraform resource.\n\nUnlike [google.logging_organization_settings.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization for which to retrieve or configure settings.\n  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_settings.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_organization_settings` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    organization,
+    disable_default_sink=null,
+    kms_key_name=null,
+    storage_location=null,
+    timeouts=null
+  ):: std.prune(a={
+    disable_default_sink: disable_default_sink,
+    kms_key_name: kms_key_name,
+    organization: organization,
+    storage_location: storage_location,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.logging_organization_settings.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDisableDefaultSink':: d.fn(help='`google.bool.withDisableDefaultSink` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the disable_default_sink field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `disable_default_sink` field.\n', args=[]),
+  withDisableDefaultSink(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_settings+: {
+        [resourceLabel]+: {
+          disable_default_sink: value,
+        },
+      },
+    },
+  },
+  '#withKmsKeyName':: d.fn(help='`google.string.withKmsKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kms_key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kms_key_name` field.\n', args=[]),
+  withKmsKeyName(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_settings+: {
+        [resourceLabel]+: {
+          kms_key_name: value,
+        },
+      },
+    },
+  },
+  '#withOrganization':: d.fn(help='`google.string.withOrganization` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the organization field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `organization` field.\n', args=[]),
+  withOrganization(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_settings+: {
+        [resourceLabel]+: {
+          organization: value,
+        },
+      },
+    },
+  },
+  '#withStorageLocation':: d.fn(help='`google.string.withStorageLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the storage_location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `storage_location` field.\n', args=[]),
+  withStorageLocation(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_settings+: {
+        [resourceLabel]+: {
+          storage_location: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_settings+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_logging_organization_settings+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/logging_project_bucket_config.libsonnet b/4.x/_gen/resources/logging_project_bucket_config.libsonnet
index 8b0ae6e0..26eb9dd8 100644
--- a/4.x/_gen/resources/logging_project_bucket_config.libsonnet
+++ b/4.x/_gen/resources/logging_project_bucket_config.libsonnet
@@ -10,7 +10,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.logging_project_bucket_config.new` injects a new `google_logging_project_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_project_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_project_bucket_config` using the reference:\n\n    $._ref.google_logging_project_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_project_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_analytics` (`bool`): Enable log analytics for the bucket. Cannot be disabled once enabled. When `null`, the `enable_analytics` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `locked` (`bool`): Whether the bucket is locked. The retention period on a locked bucket cannot be changed. Locked buckets may only be deleted if they are empty. When `null`, the `locked` field will be omitted from the resulting object.\n  - `project` (`string`): The parent project that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  index_configs:: {
+    '#new':: d.fn(help='\n`google.logging_project_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `field_path` (`string`): The LogEntry field path to index.\n  - `type` (`string`): The type of data in this index\nNote that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.\nFor example: jsonPayload.request.status\n\n**Returns**:\n  - An attribute object that represents the `index_configs` sub block.\n', args=[]),
+    new(
+      field_path,
+      type
+    ):: std.prune(a={
+      field_path: field_path,
+      type: type,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.logging_project_bucket_config.new` injects a new `google_logging_project_bucket_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_project_bucket_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_project_bucket_config` using the reference:\n\n    $._ref.google_logging_project_bucket_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_project_bucket_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_analytics` (`bool`): Enable log analytics for the bucket. Cannot be disabled once enabled. When `null`, the `enable_analytics` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `locked` (`bool`): Whether the bucket is locked. The retention period on a locked bucket cannot be changed. Locked buckets may only be deleted if they are empty. When `null`, the `locked` field will be omitted from the resulting object.\n  - `project` (`string`): The parent project that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     bucket_id,
@@ -19,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cmek_settings=null,
     description=null,
     enable_analytics=null,
+    index_configs=null,
     locked=null,
     retention_days=null,
     _meta={}
@@ -30,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cmek_settings=cmek_settings,
       description=description,
       enable_analytics=enable_analytics,
+      index_configs=index_configs,
       location=location,
       locked=locked,
       project=project,
@@ -37,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.logging_project_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_project_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_analytics` (`bool`): Enable log analytics for the bucket. Cannot be disabled once enabled. When `null`, the `enable_analytics` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `locked` (`bool`): Whether the bucket is locked. The retention period on a locked bucket cannot be changed. Locked buckets may only be deleted if they are empty. When `null`, the `locked` field will be omitted from the resulting object.\n  - `project` (`string`): The parent project that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_bucket_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.logging_project_bucket_config.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_bucket_config`\nTerraform resource.\n\nUnlike [google.logging_project_bucket_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket_id` (`string`): The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.\n  - `description` (`string`): An optional description for this bucket. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_analytics` (`bool`): Enable log analytics for the bucket. Cannot be disabled once enabled. When `null`, the `enable_analytics` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the bucket.\n  - `locked` (`bool`): Whether the bucket is locked. The retention period on a locked bucket cannot be changed. Locked buckets may only be deleted if they are empty. When `null`, the `locked` field will be omitted from the resulting object.\n  - `project` (`string`): The parent project that contains the logging bucket.\n  - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.\n  - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.\n  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.index_configs.new](#fn-index_configsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_bucket_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     bucket_id,
     location,
@@ -45,6 +57,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cmek_settings=null,
     description=null,
     enable_analytics=null,
+    index_configs=null,
     locked=null,
     retention_days=null
   ):: std.prune(a={
@@ -52,6 +65,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cmek_settings: cmek_settings,
     description: description,
     enable_analytics: enable_analytics,
+    index_configs: index_configs,
     location: location,
     locked: locked,
     project: project,
@@ -107,6 +121,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIndexConfigs':: d.fn(help='`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigs(resourceLabel, value): {
+    resource+: {
+      google_logging_project_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs: value,
+        },
+      },
+    },
+  },
+  '#withIndexConfigsMixin':: d.fn(help='`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the index_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `index_configs` field.\n', args=[]),
+  withIndexConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_logging_project_bucket_config+: {
+        [resourceLabel]+: {
+          index_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/logging_project_sink.libsonnet b/4.x/_gen/resources/logging_project_sink.libsonnet
index 667c9e6c..189f8797 100644
--- a/4.x/_gen/resources/logging_project_sink.libsonnet
+++ b/4.x/_gen/resources/logging_project_sink.libsonnet
@@ -24,12 +24,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name: name,
     }),
   },
-  '#new':: d.fn(help="\n`google.logging_project_sink.new` injects a new `google_logging_project_sink` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_project_sink.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_project_sink` using the reference:\n\n    $._ref.google_logging_project_sink.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_project_sink.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: \u0026#34;storage.googleapis.com/[GCS_BUCKET]\u0026#34; \u0026#34;bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]\u0026#34; \u0026#34;pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]\u0026#34; The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion\u0026#39;s filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.logging_project_sink.new` injects a new `google_logging_project_sink` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_project_sink.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_project_sink` using the reference:\n\n    $._ref.google_logging_project_sink.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_project_sink.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink\u0026#39;s project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: \u0026#34;storage.googleapis.com/[GCS_BUCKET]\u0026#34; \u0026#34;bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]\u0026#34; \u0026#34;pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]\u0026#34; The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion\u0026#39;s filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     destination,
     name,
     bigquery_options=null,
+    custom_writer_identity=null,
     description=null,
     disabled=null,
     exclusions=null,
@@ -42,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       bigquery_options=bigquery_options,
+      custom_writer_identity=custom_writer_identity,
       description=description,
       destination=destination,
       disabled=disabled,
@@ -53,11 +55,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.logging_project_sink.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_sink`\nTerraform resource.\n\nUnlike [google.logging_project_sink.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_sink` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.logging_project_sink.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_sink`\nTerraform resource.\n\nUnlike [google.logging_project_sink.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_sink` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     destination,
     name,
     bigquery_options=null,
+    custom_writer_identity=null,
     description=null,
     disabled=null,
     exclusions=null,
@@ -66,6 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     unique_writer_identity=null
   ):: std.prune(a={
     bigquery_options: bigquery_options,
+    custom_writer_identity: custom_writer_identity,
     description: description,
     destination: destination,
     disabled: disabled,
@@ -95,6 +99,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withCustomWriterIdentity':: d.fn(help='`google.string.withCustomWriterIdentity` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the custom_writer_identity field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `custom_writer_identity` field.\n', args=[]),
+  withCustomWriterIdentity(resourceLabel, value): {
+    resource+: {
+      google_logging_project_sink+: {
+        [resourceLabel]+: {
+          custom_writer_identity: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/looker_instance.libsonnet b/4.x/_gen/resources/looker_instance.libsonnet
index cdc277dd..495ce756 100644
--- a/4.x/_gen/resources/looker_instance.libsonnet
+++ b/4.x/_gen/resources/looker_instance.libsonnet
@@ -92,7 +92,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.looker_instance.new` injects a new `google_looker_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.looker_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.looker_instance` using the reference:\n\n    $._ref.google_looker_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_looker_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance\n- LOOKER_MODELER: standalone modeling service Default value: \u0026#34;LOOKER_CORE_TRIAL\u0026#34; Possible values: [\u0026#34;LOOKER_CORE_TRIAL\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_ENTERPRISE_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_EMBED_ANNUAL\u0026#34;, \u0026#34;LOOKER_MODELER\u0026#34;] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.looker_instance.new` injects a new `google_looker_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.looker_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.looker_instance` using the reference:\n\n    $._ref.google_looker_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_looker_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: \u0026#34;LOOKER_CORE_TRIAL\u0026#34; Possible values: [\u0026#34;LOOKER_CORE_TRIAL\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_ENTERPRISE_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_EMBED_ANNUAL\u0026#34;] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -133,7 +133,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.looker_instance.newAttrs` constructs a new object with attributes and blocks configured for the `looker_instance`\nTerraform resource.\n\nUnlike [google.looker_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance\n- LOOKER_MODELER: standalone modeling service Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL", "LOOKER_MODELER"] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `looker_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.looker_instance.newAttrs` constructs a new object with attributes and blocks configured for the `looker_instance`\nTerraform resource.\n\nUnlike [google.looker_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL"] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `looker_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     admin_settings=null,
diff --git a/4.x/_gen/resources/memcache_instance.libsonnet b/4.x/_gen/resources/memcache_instance.libsonnet
index 943115d5..7cc9bffa 100644
--- a/4.x/_gen/resources/memcache_instance.libsonnet
+++ b/4.x/_gen/resources/memcache_instance.libsonnet
@@ -46,7 +46,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       params: params,
     }),
   },
-  '#new':: d.fn(help="\n`google.memcache_instance.new` injects a new `google_memcache_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.memcache_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.memcache_instance` using the reference:\n\n    $._ref.google_memcache_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_memcache_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n\u0026#39;default\u0026#39; will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: \u0026#34;MEMCACHE_1_5\u0026#34; Possible values: [\u0026#34;MEMCACHE_1_5\u0026#34;] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.memcache_instance.new` injects a new `google_memcache_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.memcache_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.memcache_instance` using the reference:\n\n    $._ref.google_memcache_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_memcache_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n\u0026#39;default\u0026#39; will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: \u0026#34;MEMCACHE_1_5\u0026#34; Possible values: [\u0026#34;MEMCACHE_1_5\u0026#34;, \u0026#34;MEMCACHE_1_6_15\u0026#34;] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_ip_range_id` (`list`): Contains the name of allocated IP address ranges associated with\nthe private service access connection for example, \u0026#34;test-default\u0026#34;\nassociated with IP range 10.0.0.0/29. When `null`, the `reserved_ip_range_id` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -60,6 +60,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_config=null,
     project=null,
     region=null,
+    reserved_ip_range_id=null,
     timeouts=null,
     zones=null,
     _meta={}
@@ -78,12 +79,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       node_count=node_count,
       project=project,
       region=region,
+      reserved_ip_range_id=reserved_ip_range_id,
       timeouts=timeouts,
       zones=zones
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.memcache_instance.newAttrs` constructs a new object with attributes and blocks configured for the `memcache_instance`\nTerraform resource.\n\nUnlike [google.memcache_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `memcache_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.memcache_instance.newAttrs` constructs a new object with attributes and blocks configured for the `memcache_instance`\nTerraform resource.\n\nUnlike [google.memcache_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5", "MEMCACHE_1_6_15"] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_ip_range_id` (`list`): Contains the name of allocated IP address ranges associated with\nthe private service access connection for example, "test-default"\nassociated with IP range 10.0.0.0/29. When `null`, the `reserved_ip_range_id` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `memcache_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     node_count,
@@ -96,6 +98,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_config=null,
     project=null,
     region=null,
+    reserved_ip_range_id=null,
     timeouts=null,
     zones=null
   ):: std.prune(a={
@@ -110,6 +113,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_count: node_count,
     project: project,
     region: region,
+    reserved_ip_range_id: reserved_ip_range_id,
     timeouts: timeouts,
     zones: zones,
   }),
@@ -275,6 +279,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withReservedIpRangeId':: d.fn(help='`google.list.withReservedIpRangeId` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the reserved_ip_range_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `reserved_ip_range_id` field.\n', args=[]),
+  withReservedIpRangeId(resourceLabel, value): {
+    resource+: {
+      google_memcache_instance+: {
+        [resourceLabel]+: {
+          reserved_ip_range_id: value,
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/migration_center_group.libsonnet b/4.x/_gen/resources/migration_center_group.libsonnet
new file mode 100644
index 00000000..401d11d3
--- /dev/null
+++ b/4.x/_gen/resources/migration_center_group.libsonnet
@@ -0,0 +1,140 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='migration_center_group', url='', help='`migration_center_group` represents the `google_migration_center_group` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.migration_center_group.new` injects a new `google_migration_center_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.migration_center_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.migration_center_group` using the reference:\n\n    $._ref.google_migration_center_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_migration_center_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. The description of the group. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User-friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `group_id` (`string`): Required. User specified ID for the group. It will become the last component of the group name. The ID must be unique within the project, must conform with RFC-1034, is restricted to lower-cased letters, and has a maximum length of 63 characters. The ID must match the regular expression: \u0026#39;[a-z]([a-z0-9-]{0,61}[a-z0-9])?\u0026#39;.\n  - `labels` (`obj`): Labels as key value pairs. \n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the group.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.migration_center_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    group_id,
+    location,
+    description=null,
+    display_name=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_migration_center_group',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      display_name=display_name,
+      group_id=group_id,
+      labels=labels,
+      location=location,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.migration_center_group.newAttrs` constructs a new object with attributes and blocks configured for the `migration_center_group`\nTerraform resource.\n\nUnlike [google.migration_center_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. The description of the group. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User-friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `group_id` (`string`): Required. User specified ID for the group. It will become the last component of the group name. The ID must be unique within the project, must conform with RFC-1034, is restricted to lower-cased letters, and has a maximum length of 63 characters. The ID must match the regular expression: '[a-z]([a-z0-9-]{0,61}[a-z0-9])?'.\n  - `labels` (`obj`): Labels as key value pairs. \n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the group.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.migration_center_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `migration_center_group` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    group_id,
+    location,
+    description=null,
+    display_name=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    display_name: display_name,
+    group_id: group_id,
+    labels: labels,
+    location: location,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.migration_center_group.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withGroupId':: d.fn(help='`google.string.withGroupId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the group_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `group_id` field.\n', args=[]),
+  withGroupId(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          group_id: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_migration_center_group+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/ml_engine_model.libsonnet b/4.x/_gen/resources/ml_engine_model.libsonnet
index f2180c1a..d2ff229a 100644
--- a/4.x/_gen/resources/ml_engine_model.libsonnet
+++ b/4.x/_gen/resources/ml_engine_model.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name: name,
     }),
   },
-  '#new':: d.fn(help="\n`google.ml_engine_model.new` injects a new `google_ml_engine_model` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.ml_engine_model.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.ml_engine_model` using the reference:\n\n    $._ref.google_ml_engine_model.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_ml_engine_model.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.ml_engine_model.new` injects a new `google_ml_engine_model` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.ml_engine_model.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.ml_engine_model` using the reference:\n\n    $._ref.google_ml_engine_model.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_ml_engine_model.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.ml_engine_model.newAttrs` constructs a new object with attributes and blocks configured for the `ml_engine_model`\nTerraform resource.\n\nUnlike [google.ml_engine_model.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `ml_engine_model` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.ml_engine_model.newAttrs` constructs a new object with attributes and blocks configured for the `ml_engine_model`\nTerraform resource.\n\nUnlike [google.ml_engine_model.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `ml_engine_model` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     default_version=null,
@@ -62,13 +62,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.ml_engine_model.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.ml_engine_model.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withDefaultVersion':: d.fn(help='`google.list[obj].withDefaultVersion` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the default_version field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDefaultVersionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `default_version` field.\n', args=[]),
diff --git a/4.x/_gen/resources/monitoring_alert_policy.libsonnet b/4.x/_gen/resources/monitoring_alert_policy.libsonnet
index 310dbf27..0008be44 100644
--- a/4.x/_gen/resources/monitoring_alert_policy.libsonnet
+++ b/4.x/_gen/resources/monitoring_alert_policy.libsonnet
@@ -106,7 +106,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
     condition_prometheus_query_language:: {
-      '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new` constructs a new object with attributes and blocks configured for the `condition_prometheus_query_language`\nTerraform sub block.\n\n\n\n**Args**:\n  - `alert_rule` (`string`): The alerting rule name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future.\n\nThis field is optional. If this field is not empty, then it must be a\nvalid Prometheus label name. When `null`, the `alert_rule` field will be omitted from the resulting object.\n  - `duration` (`string`): Alerts are considered firing once their PromQL expression evaluated\nto be "true" for this long. Alerts whose PromQL expression was not\nevaluated to be "true" for long enough are considered pending. The\ndefault value is zero. Must be zero or positive. When `null`, the `duration` field will be omitted from the resulting object.\n  - `evaluation_interval` (`string`): How often this rule should be evaluated. Must be a positive multiple\nof 30 seconds or missing. The default value is 30 seconds. If this\nPrometheusQueryLanguageCondition was generated from a Prometheus\nalerting rule, then this value should be taken from the enclosing\nrule group. When `null`, the `evaluation_interval` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to add to or overwrite in the PromQL query result. Label names\nmust be valid.\n\nLabel values can be templatized by using variables. The only available\nvariable names are the names of the labels in the PromQL result, including\n"__name__" and "value". "labels" may be empty. This field is intended to be\nused for organizing and identifying the AlertPolicy When `null`, the `labels` field will be omitted from the resulting object.\n  - `query` (`string`): The PromQL expression to evaluate. Every evaluation cycle this\nexpression is evaluated at the current time, and all resultant time\nseries become pending/firing alerts. This field must not be empty.\n  - `rule_group` (`string`): The rule group name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future.\n\nThis field is optional. If this field is not empty, then it must be a\nvalid Prometheus label name. When `null`, the `rule_group` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition_prometheus_query_language` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new` constructs a new object with attributes and blocks configured for the `condition_prometheus_query_language`\nTerraform sub block.\n\n\n\n**Args**:\n  - `alert_rule` (`string`): The alerting rule name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future.\n\nThis field is optional. If this field is not empty, then it must be a\nvalid Prometheus label name. When `null`, the `alert_rule` field will be omitted from the resulting object.\n  - `duration` (`string`): Alerts are considered firing once their PromQL expression evaluated\nto be "true" for this long. Alerts whose PromQL expression was not\nevaluated to be "true" for long enough are considered pending. The\ndefault value is zero. Must be zero or positive. When `null`, the `duration` field will be omitted from the resulting object.\n  - `evaluation_interval` (`string`): How often this rule should be evaluated. Must be a positive multiple\nof 30 seconds or missing. The default value is 30 seconds. If this\nPrometheusQueryLanguageCondition was generated from a Prometheus\nalerting rule, then this value should be taken from the enclosing\nrule group. When `null`, the `evaluation_interval` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to add to or overwrite in the PromQL query result. Label names\nmust be valid.\n\nLabel values can be templatized by using variables. The only available\nvariable names are the names of the labels in the PromQL result, including\n"__name__" and "value". "labels" may be empty. This field is intended to be\nused for organizing and identifying the AlertPolicy When `null`, the `labels` field will be omitted from the resulting object.\n  - `query` (`string`): The PromQL expression to evaluate. Every evaluation cycle this\nexpression is evaluated at the current time, and all resultant time\nseries become pending/firing alerts. This field must not be empty.\n  - `rule_group` (`string`): The rule group name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future. This field is optional. When `null`, the `rule_group` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition_prometheus_query_language` sub block.\n', args=[]),
       new(
         query,
         alert_rule=null,
@@ -195,7 +195,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
-    '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `display_name` (`string`): A short name or phrase used to identify the\ncondition in dashboards, notifications, and\nincidents. To avoid confusion, don't use the same\ndisplay name for multiple conditions in the same\npolicy.\n  - `condition_absent` (`list[obj]`): A condition that checks that a time series\ncontinues to receive new data points. When `null`, the `condition_absent` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_absent.new](#fn-conditionscondition_absentnew) constructor.\n  - `condition_matched_log` (`list[obj]`): A condition that checks for log messages matching given constraints.\nIf set, no other conditions can be present. When `null`, the `condition_matched_log` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_matched_log.new](#fn-conditionscondition_matched_lognew) constructor.\n  - `condition_monitoring_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream When `null`, the `condition_monitoring_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_monitoring_query_language.new](#fn-conditionscondition_monitoring_query_languagenew) constructor.\n  - `condition_prometheus_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream\n\nA condition type that allows alert policies to be defined using\nPrometheus Query Language (PromQL).\n\nThe PrometheusQueryLanguageCondition message contains information\nfrom a Prometheus alerting rule and its associated rule group. When `null`, the `condition_prometheus_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new](#fn-conditionscondition_prometheus_query_languagenew) constructor.\n  - `condition_threshold` (`list[obj]`): A condition that compares a time series against a\nthreshold. When `null`, the `condition_threshold` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_threshold.new](#fn-conditionscondition_thresholdnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `display_name` (`string`): A short name or phrase used to identify the\ncondition in dashboards, notifications, and\nincidents. To avoid confusion, don't use the same\ndisplay name for multiple conditions in the same\npolicy.\n  - `condition_absent` (`list[obj]`): A condition that checks that a time series\ncontinues to receive new data points. When `null`, the `condition_absent` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_absent.new](#fn-conditionscondition_absentnew) constructor.\n  - `condition_matched_log` (`list[obj]`): A condition that checks for log messages matching given constraints.\nIf set, no other conditions can be present. When `null`, the `condition_matched_log` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_matched_log.new](#fn-conditionscondition_matched_lognew) constructor.\n  - `condition_monitoring_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream When `null`, the `condition_monitoring_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_monitoring_query_language.new](#fn-conditionscondition_monitoring_query_languagenew) constructor.\n  - `condition_prometheus_query_language` (`list[obj]`): A condition type that allows alert policies to be defined using\nPrometheus Query Language (PromQL).\n\nThe PrometheusQueryLanguageCondition message contains information\nfrom a Prometheus alerting rule and its associated rule group. When `null`, the `condition_prometheus_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new](#fn-conditionscondition_prometheus_query_languagenew) constructor.\n  - `condition_threshold` (`list[obj]`): A condition that compares a time series against a\nthreshold. When `null`, the `condition_threshold` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_threshold.new](#fn-conditionscondition_thresholdnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
     new(
       display_name,
       condition_absent=null,
@@ -213,16 +213,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   documentation:: {
-    '#new':: d.fn(help='\n`google.monitoring_alert_policy.documentation.new` constructs a new object with attributes and blocks configured for the `documentation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `content` (`string`): The text of the documentation, interpreted according to mimeType.\nThe content may not exceed 8,192 Unicode characters and may not\nexceed more than 10,240 bytes when encoded in UTF-8 format,\nwhichever is smaller. When `null`, the `content` field will be omitted from the resulting object.\n  - `mime_type` (`string`): The format of the content field. Presently, only the value\n"text/markdown" is supported. When `null`, the `mime_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `documentation` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_alert_policy.documentation.new` constructs a new object with attributes and blocks configured for the `documentation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `content` (`string`): The text of the documentation, interpreted according to mimeType.\nThe content may not exceed 8,192 Unicode characters and may not\nexceed more than 10,240 bytes when encoded in UTF-8 format,\nwhichever is smaller. When `null`, the `content` field will be omitted from the resulting object.\n  - `mime_type` (`string`): The format of the content field. Presently, only the value\n"text/markdown" is supported. When `null`, the `mime_type` field will be omitted from the resulting object.\n  - `subject` (`string`): The subject line of the notification. The subject line may not\nexceed 10,240 bytes. In notifications generated by this policy the contents\nof the subject line after variable expansion will be truncated to 255 bytes\nor shorter at the latest UTF-8 character boundary. When `null`, the `subject` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `documentation` sub block.\n', args=[]),
     new(
       content=null,
-      mime_type=null
+      mime_type=null,
+      subject=null
     ):: std.prune(a={
       content: content,
       mime_type: mime_type,
+      subject: subject,
     }),
   },
-  '#new':: d.fn(help="\n`google.monitoring_alert_policy.new` injects a new `google_monitoring_alert_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.monitoring_alert_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.monitoring_alert_policy` using the reference:\n\n    $._ref.google_monitoring_alert_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_monitoring_alert_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `combiner` (`string`): How to combine the results of multiple conditions to\ndetermine if an incident should be opened. Possible values: [\u0026#34;AND\u0026#34;, \u0026#34;OR\u0026#34;, \u0026#34;AND_WITH_MATCHING_RESOURCE\u0026#34;]\n  - `display_name` (`string`): A short name or phrase used to identify the policy in\ndashboards, notifications, and incidents. To avoid confusion, don\u0026#39;t use\nthe same display name for multiple policies in the same project. The\nname is limited to 512 Unicode characters.\n  - `enabled` (`bool`): Whether or not the policy is enabled. The default is true. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `notification_channels` (`list`): Identifies the notification channels to which notifications should be\nsent when incidents are opened or closed or when new violations occur\non an already opened incident. Each element of this array corresponds\nto the name field in each of the NotificationChannel objects that are\nreturned from the notificationChannels.list method. The syntax of the\nentries in this field is\n\u0026#39;projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]\u0026#39; When `null`, the `notification_channels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy\nobjects.The field can contain up to 64 entries. Each key and value is limited\nto 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values\ncan contain only lowercase letters, numerals, underscores, and dashes. Keys\nmust begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `alert_strategy` (`list[obj]`): Control over how this alert policy\u0026#39;s notification channels are notified. When `null`, the `alert_strategy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.alert_strategy.new](#fn-alert_strategynew) constructor.\n  - `conditions` (`list[obj]`): A list of conditions for the policy. The conditions are combined by\nAND or OR according to the combiner field. If the combined conditions\nevaluate to true, then an incident is created. A policy can have from\none to six conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.new](#fn-conditionsnew) constructor.\n  - `documentation` (`list[obj]`): Documentation that is included with notifications and incidents related\nto this policy. Best practice is for the documentation to include information\nto help responders understand, mitigate, escalate, and correct the underlying\nproblems detected by the alerting policy. Notification channels that have\nlimited capacity might not show this documentation. When `null`, the `documentation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.documentation.new](#fn-documentationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.monitoring_alert_policy.new` injects a new `google_monitoring_alert_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.monitoring_alert_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.monitoring_alert_policy` using the reference:\n\n    $._ref.google_monitoring_alert_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_monitoring_alert_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `combiner` (`string`): How to combine the results of multiple conditions to\ndetermine if an incident should be opened. Possible values: [\u0026#34;AND\u0026#34;, \u0026#34;OR\u0026#34;, \u0026#34;AND_WITH_MATCHING_RESOURCE\u0026#34;]\n  - `display_name` (`string`): A short name or phrase used to identify the policy in\ndashboards, notifications, and incidents. To avoid confusion, don\u0026#39;t use\nthe same display name for multiple policies in the same project. The\nname is limited to 512 Unicode characters.\n  - `enabled` (`bool`): Whether or not the policy is enabled. The default is true. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `notification_channels` (`list`): Identifies the notification channels to which notifications should be\nsent when incidents are opened or closed or when new violations occur\non an already opened incident. Each element of this array corresponds\nto the name field in each of the NotificationChannel objects that are\nreturned from the notificationChannels.list method. The syntax of the\nentries in this field is\n\u0026#39;projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]\u0026#39; When `null`, the `notification_channels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `severity` (`string`): The severity of an alert policy indicates how important incidents generated\nby that policy are. The severity level will be displayed on the Incident\ndetail page and in notifications. Possible values: [\u0026#34;CRITICAL\u0026#34;, \u0026#34;ERROR\u0026#34;, \u0026#34;WARNING\u0026#34;] When `null`, the `severity` field will be omitted from the resulting object.\n  - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy\nobjects.The field can contain up to 64 entries. Each key and value is limited\nto 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values\ncan contain only lowercase letters, numerals, underscores, and dashes. Keys\nmust begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `alert_strategy` (`list[obj]`): Control over how this alert policy\u0026#39;s notification channels are notified. When `null`, the `alert_strategy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.alert_strategy.new](#fn-alert_strategynew) constructor.\n  - `conditions` (`list[obj]`): A list of conditions for the policy. The conditions are combined by\nAND or OR according to the combiner field. If the combined conditions\nevaluate to true, then an incident is created. A policy can have from\none to six conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.new](#fn-conditionsnew) constructor.\n  - `documentation` (`list[obj]`): Documentation that is included with notifications and incidents related\nto this policy. Best practice is for the documentation to include information\nto help responders understand, mitigate, escalate, and correct the underlying\nproblems detected by the alerting policy. Notification channels that have\nlimited capacity might not show this documentation. When `null`, the `documentation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.documentation.new](#fn-documentationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     combiner,
@@ -233,6 +235,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enabled=null,
     notification_channels=null,
     project=null,
+    severity=null,
     timeouts=null,
     user_labels=null,
     _meta={}
@@ -248,12 +251,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enabled=enabled,
       notification_channels=notification_channels,
       project=project,
+      severity=severity,
       timeouts=timeouts,
       user_labels=user_labels
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.monitoring_alert_policy.newAttrs` constructs a new object with attributes and blocks configured for the `monitoring_alert_policy`\nTerraform resource.\n\nUnlike [google.monitoring_alert_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `combiner` (`string`): How to combine the results of multiple conditions to\ndetermine if an incident should be opened. Possible values: ["AND", "OR", "AND_WITH_MATCHING_RESOURCE"]\n  - `display_name` (`string`): A short name or phrase used to identify the policy in\ndashboards, notifications, and incidents. To avoid confusion, don't use\nthe same display name for multiple policies in the same project. The\nname is limited to 512 Unicode characters.\n  - `enabled` (`bool`): Whether or not the policy is enabled. The default is true. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `notification_channels` (`list`): Identifies the notification channels to which notifications should be\nsent when incidents are opened or closed or when new violations occur\non an already opened incident. Each element of this array corresponds\nto the name field in each of the NotificationChannel objects that are\nreturned from the notificationChannels.list method. The syntax of the\nentries in this field is\n'projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]' When `null`, the `notification_channels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy\nobjects.The field can contain up to 64 entries. Each key and value is limited\nto 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values\ncan contain only lowercase letters, numerals, underscores, and dashes. Keys\nmust begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `alert_strategy` (`list[obj]`): Control over how this alert policy's notification channels are notified. When `null`, the `alert_strategy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.alert_strategy.new](#fn-alert_strategynew) constructor.\n  - `conditions` (`list[obj]`): A list of conditions for the policy. The conditions are combined by\nAND or OR according to the combiner field. If the combined conditions\nevaluate to true, then an incident is created. A policy can have from\none to six conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.new](#fn-conditionsnew) constructor.\n  - `documentation` (`list[obj]`): Documentation that is included with notifications and incidents related\nto this policy. Best practice is for the documentation to include information\nto help responders understand, mitigate, escalate, and correct the underlying\nproblems detected by the alerting policy. Notification channels that have\nlimited capacity might not show this documentation. When `null`, the `documentation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.documentation.new](#fn-documentationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `monitoring_alert_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.monitoring_alert_policy.newAttrs` constructs a new object with attributes and blocks configured for the `monitoring_alert_policy`\nTerraform resource.\n\nUnlike [google.monitoring_alert_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `combiner` (`string`): How to combine the results of multiple conditions to\ndetermine if an incident should be opened. Possible values: ["AND", "OR", "AND_WITH_MATCHING_RESOURCE"]\n  - `display_name` (`string`): A short name or phrase used to identify the policy in\ndashboards, notifications, and incidents. To avoid confusion, don't use\nthe same display name for multiple policies in the same project. The\nname is limited to 512 Unicode characters.\n  - `enabled` (`bool`): Whether or not the policy is enabled. The default is true. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `notification_channels` (`list`): Identifies the notification channels to which notifications should be\nsent when incidents are opened or closed or when new violations occur\non an already opened incident. Each element of this array corresponds\nto the name field in each of the NotificationChannel objects that are\nreturned from the notificationChannels.list method. The syntax of the\nentries in this field is\n'projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]' When `null`, the `notification_channels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `severity` (`string`): The severity of an alert policy indicates how important incidents generated\nby that policy are. The severity level will be displayed on the Incident\ndetail page and in notifications. Possible values: ["CRITICAL", "ERROR", "WARNING"] When `null`, the `severity` field will be omitted from the resulting object.\n  - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy\nobjects.The field can contain up to 64 entries. Each key and value is limited\nto 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values\ncan contain only lowercase letters, numerals, underscores, and dashes. Keys\nmust begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `alert_strategy` (`list[obj]`): Control over how this alert policy's notification channels are notified. When `null`, the `alert_strategy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.alert_strategy.new](#fn-alert_strategynew) constructor.\n  - `conditions` (`list[obj]`): A list of conditions for the policy. The conditions are combined by\nAND or OR according to the combiner field. If the combined conditions\nevaluate to true, then an incident is created. A policy can have from\none to six conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.new](#fn-conditionsnew) constructor.\n  - `documentation` (`list[obj]`): Documentation that is included with notifications and incidents related\nto this policy. Best practice is for the documentation to include information\nto help responders understand, mitigate, escalate, and correct the underlying\nproblems detected by the alerting policy. Notification channels that have\nlimited capacity might not show this documentation. When `null`, the `documentation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.documentation.new](#fn-documentationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `monitoring_alert_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     combiner,
     display_name,
@@ -263,6 +267,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enabled=null,
     notification_channels=null,
     project=null,
+    severity=null,
     timeouts=null,
     user_labels=null
   ):: std.prune(a={
@@ -274,6 +279,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enabled: enabled,
     notification_channels: notification_channels,
     project: project,
+    severity: severity,
     timeouts: timeouts,
     user_labels: user_labels,
   }),
@@ -399,6 +405,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSeverity':: d.fn(help='`google.string.withSeverity` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the severity field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `severity` field.\n', args=[]),
+  withSeverity(resourceLabel, value): {
+    resource+: {
+      google_monitoring_alert_policy+: {
+        [resourceLabel]+: {
+          severity: value,
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/monitoring_uptime_check_config.libsonnet b/4.x/_gen/resources/monitoring_uptime_check_config.libsonnet
index 20a527d7..632790ad 100644
--- a/4.x/_gen/resources/monitoring_uptime_check_config.libsonnet
+++ b/4.x/_gen/resources/monitoring_uptime_check_config.libsonnet
@@ -45,15 +45,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         username: username,
       }),
     },
-    '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.http_check.new` constructs a new object with attributes and blocks configured for the `http_check`\nTerraform sub block.\n\n\n\n**Args**:\n  - `body` (`string`): The request body associated with the HTTP POST request. If contentType is URL_ENCODED, the body passed in must be URL-encoded. Users can provide a Content-Length header via the headers field or the API will do so. If the requestMethod is GET and body is not empty, the API will return an error. The maximum byte size is 1 megabyte. Note - As with all bytes fields JSON representations are base64 encoded. e.g. "foo=bar" in URL-encoded form is "foo%3Dbar" and in base64 encoding is "Zm9vJTI1M0RiYXI=". When `null`, the `body` field will be omitted from the resulting object.\n  - `content_type` (`string`): The content type to use for the check. Possible values: ["TYPE_UNSPECIFIED", "URL_ENCODED"] When `null`, the `content_type` field will be omitted from the resulting object.\n  - `headers` (`obj`): The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described at https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100. When `null`, the `headers` field will be omitted from the resulting object.\n  - `mask_headers` (`bool`): Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if mask_headers is set to True then the headers will be obscured with ******. When `null`, the `mask_headers` field will be omitted from the resulting object.\n  - `path` (`string`): The path to the page to run the check against. Will be combined with the host (specified within the MonitoredResource) and port to construct the full URL. If the provided path does not begin with "/", a "/" will be prepended automatically. Optional (defaults to "/"). When `null`, the `path` field will be omitted from the resulting object.\n  - `port` (`number`): The port to the page to run the check against. Will be combined with host (specified within the MonitoredResource) and path to construct the full URL. Optional (defaults to 80 without SSL, or 443 with SSL). When `null`, the `port` field will be omitted from the resulting object.\n  - `request_method` (`string`): The HTTP request method to use for the check. If set to METHOD_UNSPECIFIED then requestMethod defaults to GET. Default value: "GET" Possible values: ["METHOD_UNSPECIFIED", "GET", "POST"] When `null`, the `request_method` field will be omitted from the resulting object.\n  - `use_ssl` (`bool`): If true, use HTTPS instead of HTTP to run the check. When `null`, the `use_ssl` field will be omitted from the resulting object.\n  - `validate_ssl` (`bool`): Boolean specifying whether to include SSL certificate validation as a part of the Uptime check. Only applies to checks where monitoredResource is set to uptime_url. If useSsl is false, setting validateSsl to true has no effect. When `null`, the `validate_ssl` field will be omitted from the resulting object.\n  - `accepted_response_status_codes` (`list[obj]`): If present, the check will only pass if the HTTP response status code is in this set of status codes. If empty, the HTTP status code will only pass if the HTTP status code is 200-299. When `null`, the `accepted_response_status_codes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.accepted_response_status_codes.new](#fn-http_checkaccepted_response_status_codesnew) constructor.\n  - `auth_info` (`list[obj]`): The authentication information. Optional when creating an HTTP check; defaults to empty. When `null`, the `auth_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.auth_info.new](#fn-http_checkauth_infonew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `http_check` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.http_check.new` constructs a new object with attributes and blocks configured for the `http_check`\nTerraform sub block.\n\n\n\n**Args**:\n  - `body` (`string`): The request body associated with the HTTP POST request. If 'content_type' is 'URL_ENCODED', the body passed in must be URL-encoded. Users can provide a 'Content-Length' header via the 'headers' field or the API will do so. If the 'request_method' is 'GET' and 'body' is not empty, the API will return an error. The maximum byte size is 1 megabyte. Note - As with all bytes fields JSON representations are base64 encoded. e.g. 'foo=bar' in URL-encoded form is 'foo%3Dbar' and in base64 encoding is 'Zm9vJTI1M0RiYXI='. When `null`, the `body` field will be omitted from the resulting object.\n  - `content_type` (`string`): The content type to use for the check. Possible values: ["TYPE_UNSPECIFIED", "URL_ENCODED", "USER_PROVIDED"] When `null`, the `content_type` field will be omitted from the resulting object.\n  - `custom_content_type` (`string`): A user provided content type header to use for the check. The invalid configurations outlined in the 'content_type' field apply to custom_content_type', as well as the following 1. 'content_type' is 'URL_ENCODED' and 'custom_content_type' is set. 2. 'content_type' is 'USER_PROVIDED' and 'custom_content_type' is not set. When `null`, the `custom_content_type` field will be omitted from the resulting object.\n  - `headers` (`obj`): The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described in [RFC 2616 (page 31)](https://www.w3.org/Protocols/rfc2616/rfc2616.txt). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100. When `null`, the `headers` field will be omitted from the resulting object.\n  - `mask_headers` (`bool`): Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if 'mask_headers' is set to 'true' then the headers will be obscured with '******'. When `null`, the `mask_headers` field will be omitted from the resulting object.\n  - `path` (`string`): The path to the page to run the check against. Will be combined with the host (specified within the MonitoredResource) and port to construct the full URL. If the provided path does not begin with '/', a '/' will be prepended automatically. Optional (defaults to '/'). When `null`, the `path` field will be omitted from the resulting object.\n  - `port` (`number`): The port to the page to run the check against. Will be combined with 'host' (specified within the ['monitored_resource'](#nested_monitored_resource)) and path to construct the full URL. Optional (defaults to 80 without SSL, or 443 with SSL). When `null`, the `port` field will be omitted from the resulting object.\n  - `request_method` (`string`): The HTTP request method to use for the check. If set to 'METHOD_UNSPECIFIED' then 'request_method' defaults to 'GET'. Default value: "GET" Possible values: ["METHOD_UNSPECIFIED", "GET", "POST"] When `null`, the `request_method` field will be omitted from the resulting object.\n  - `use_ssl` (`bool`): If true, use HTTPS instead of HTTP to run the check. When `null`, the `use_ssl` field will be omitted from the resulting object.\n  - `validate_ssl` (`bool`): Boolean specifying whether to include SSL certificate validation as a part of the Uptime check. Only applies to checks where 'monitored_resource' is set to 'uptime_url'. If 'use_ssl' is 'false', setting 'validate_ssl' to 'true' has no effect. When `null`, the `validate_ssl` field will be omitted from the resulting object.\n  - `accepted_response_status_codes` (`list[obj]`): If present, the check will only pass if the HTTP response status code is in this set of status codes. If empty, the HTTP status code will only pass if the HTTP status code is 200-299. When `null`, the `accepted_response_status_codes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.accepted_response_status_codes.new](#fn-http_checkaccepted_response_status_codesnew) constructor.\n  - `auth_info` (`list[obj]`): The authentication information. Optional when creating an HTTP check; defaults to empty. When `null`, the `auth_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.auth_info.new](#fn-http_checkauth_infonew) constructor.\n  - `ping_config` (`list[obj]`): Contains information needed to add pings to an HTTP check. When `null`, the `ping_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.ping_config.new](#fn-http_checkping_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `http_check` sub block.\n', args=[]),
     new(
       accepted_response_status_codes=null,
       auth_info=null,
       body=null,
       content_type=null,
+      custom_content_type=null,
       headers=null,
       mask_headers=null,
       path=null,
+      ping_config=null,
       port=null,
       request_method=null,
       use_ssl=null,
@@ -63,17 +65,27 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       auth_info: auth_info,
       body: body,
       content_type: content_type,
+      custom_content_type: custom_content_type,
       headers: headers,
       mask_headers: mask_headers,
       path: path,
+      ping_config: ping_config,
       port: port,
       request_method: request_method,
       use_ssl: use_ssl,
       validate_ssl: validate_ssl,
     }),
+    ping_config:: {
+      '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.http_check.ping_config.new` constructs a new object with attributes and blocks configured for the `ping_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pings_count` (`number`): Number of ICMP pings. A maximum of 3 ICMP pings is currently supported.\n\n**Returns**:\n  - An attribute object that represents the `ping_config` sub block.\n', args=[]),
+      new(
+        pings_count
+      ):: std.prune(a={
+        pings_count: pings_count,
+      }),
+    },
   },
   monitored_resource:: {
-    '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.monitored_resource.new` constructs a new object with attributes and blocks configured for the `monitored_resource`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels "project_id", "instance_id", and "zone".\n  - `type` (`string`): The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types (https://cloud.google.com/monitoring/api/resources) and Logging resource types (https://cloud.google.com/logging/docs/api/v2/resource-list).\n\n**Returns**:\n  - An attribute object that represents the `monitored_resource` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.monitored_resource.new` constructs a new object with attributes and blocks configured for the `monitored_resource`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels 'project_id', 'instance_id', and 'zone'.\n  - `type` (`string`): The monitored resource type. This field must match the type field of a ['MonitoredResourceDescriptor'](https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is 'gce_instance'. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).\n\n**Returns**:\n  - An attribute object that represents the `monitored_resource` sub block.\n', args=[]),
     new(
       labels,
       type
@@ -82,7 +94,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.monitoring_uptime_check_config.new` injects a new `google_monitoring_uptime_check_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.monitoring_uptime_check_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.monitoring_uptime_check_config` using the reference:\n\n    $._ref.google_monitoring_uptime_check_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_monitoring_uptime_check_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is servicedirectory_service, checkerType must be set to VPC_CHECKERS. Possible values: [\u0026#34;STATIC_IP_CHECKERS\u0026#34;, \u0026#34;VPC_CHECKERS\u0026#34;] When `null`, the `checker_type` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the uptime check configuration. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.\n  - `period` (`string`): How often, in seconds, the uptime check is performed. Currently, the only supported values are 60s (1 minute), 300s (5 minutes), 600s (10 minutes), and 900s (15 minutes). Optional, defaults to 300s. When `null`, the `period` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `selected_regions` (`list`): The list of regions from which the check will be run. Some regions contain one location, and others contain more than one. If this field is specified, enough regions to include a minimum of 3 locations must be provided, or an error message is returned. Not specifying this field will result in uptime checks running from all regions. When `null`, the `selected_regions` field will be omitted from the resulting object.\n  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). Accepted formats https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration\n  - `content_matchers` (`list[obj]`): The expected content on the page the check is run against. Currently, only the first entry in the list is supported, and other entries will be ignored. The server will look for an exact match of the string in the page response\u0026#39;s content. This field is optional and should only be specified if a content match is required. When `null`, the `content_matchers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.content_matchers.new](#fn-content_matchersnew) constructor.\n  - `http_check` (`list[obj]`): Contains information needed to make an HTTP or HTTPS check. When `null`, the `http_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.new](#fn-http_checknew) constructor.\n  - `monitored_resource` (`list[obj]`): The monitored resource (https://cloud.google.com/monitoring/api/resources) associated with the configuration. The following monitored resource types are supported for uptime checks:  uptime_url  gce_instance  gae_app  aws_ec2_instance aws_elb_load_balancer  k8s_service  servicedirectory_service When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.\n  - `resource_group` (`list[obj]`): The group resource associated with the configuration. When `null`, the `resource_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.resource_group.new](#fn-resource_groupnew) constructor.\n  - `synthetic_monitor` (`list[obj]`): A Synthetic Monitor deployed to a Cloud Functions V2 instance. When `null`, the `synthetic_monitor` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.synthetic_monitor.new](#fn-synthetic_monitornew) constructor.\n  - `tcp_check` (`list[obj]`): Contains information needed to make a TCP check. When `null`, the `tcp_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.new](#fn-tcp_checknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.monitoring_uptime_check_config.new` injects a new `google_monitoring_uptime_check_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.monitoring_uptime_check_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.monitoring_uptime_check_config` using the reference:\n\n    $._ref.google_monitoring_uptime_check_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_monitoring_uptime_check_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is \u0026#39;servicedirectory_service\u0026#39;, \u0026#39;checker_type\u0026#39; must be set to \u0026#39;VPC_CHECKERS\u0026#39;. Possible values: [\u0026#34;STATIC_IP_CHECKERS\u0026#34;, \u0026#34;VPC_CHECKERS\u0026#34;] When `null`, the `checker_type` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the uptime check configuration. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.\n  - `period` (`string`): How often, in seconds, the uptime check is performed. Currently, the only supported values are 60s (1 minute), 300s (5 minutes), 600s (10 minutes), and 900s (15 minutes). Optional, defaults to 300s. When `null`, the `period` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `selected_regions` (`list`): The list of regions from which the check will be run. Some regions contain one location, and others contain more than one. If this field is specified, enough regions to include a minimum of 3 locations must be provided, or an error message is returned. Not specifying this field will result in uptime checks running from all regions. When `null`, the `selected_regions` field will be omitted from the resulting object.\n  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). [See the accepted formats]( https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration)\n  - `user_labels` (`obj`): User-supplied key/value data to be used for organizing and identifying the \u0026#39;UptimeCheckConfig\u0026#39; objects. The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `content_matchers` (`list[obj]`): The expected content on the page the check is run against. Currently, only the first entry in the list is supported, and other entries will be ignored. The server will look for an exact match of the string in the page response\u0026#39;s content. This field is optional and should only be specified if a content match is required. When `null`, the `content_matchers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.content_matchers.new](#fn-content_matchersnew) constructor.\n  - `http_check` (`list[obj]`): Contains information needed to make an HTTP or HTTPS check. When `null`, the `http_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.new](#fn-http_checknew) constructor.\n  - `monitored_resource` (`list[obj]`): The [monitored resource]\n(https://cloud.google.com/monitoring/api/resources) associated with the\nconfiguration. The following monitored resource types are supported for\nuptime checks:\n* \u0026#39;aws_ec2_instance\u0026#39;\n* \u0026#39;aws_elb_load_balancer\u0026#39;\n* \u0026#39;gae_app\n* \u0026#39;gce_instance\u0026#39;\n* \u0026#39;k8s_service\u0026#39;\n* \u0026#39;servicedirectory_service\u0026#39;\n* \u0026#39;uptime_url\u0026#39; When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.\n  - `resource_group` (`list[obj]`): The group resource associated with the configuration. When `null`, the `resource_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.resource_group.new](#fn-resource_groupnew) constructor.\n  - `synthetic_monitor` (`list[obj]`): A Synthetic Monitor deployed to a Cloud Functions V2 instance. When `null`, the `synthetic_monitor` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.synthetic_monitor.new](#fn-synthetic_monitornew) constructor.\n  - `tcp_check` (`list[obj]`): Contains information needed to make a TCP check. When `null`, the `tcp_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.new](#fn-tcp_checknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -98,6 +110,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     synthetic_monitor=null,
     tcp_check=null,
     timeouts=null,
+    user_labels=null,
     _meta={}
   ):: tf.withResource(
     type='google_monitoring_uptime_check_config',
@@ -115,11 +128,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       synthetic_monitor=synthetic_monitor,
       tcp_check=tcp_check,
       timeout=timeout,
-      timeouts=timeouts
+      timeouts=timeouts,
+      user_labels=user_labels
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.monitoring_uptime_check_config.newAttrs` constructs a new object with attributes and blocks configured for the `monitoring_uptime_check_config`\nTerraform resource.\n\nUnlike [google.monitoring_uptime_check_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is servicedirectory_service, checkerType must be set to VPC_CHECKERS. Possible values: ["STATIC_IP_CHECKERS", "VPC_CHECKERS"] When `null`, the `checker_type` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the uptime check configuration. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.\n  - `period` (`string`): How often, in seconds, the uptime check is performed. Currently, the only supported values are 60s (1 minute), 300s (5 minutes), 600s (10 minutes), and 900s (15 minutes). Optional, defaults to 300s. When `null`, the `period` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `selected_regions` (`list`): The list of regions from which the check will be run. Some regions contain one location, and others contain more than one. If this field is specified, enough regions to include a minimum of 3 locations must be provided, or an error message is returned. Not specifying this field will result in uptime checks running from all regions. When `null`, the `selected_regions` field will be omitted from the resulting object.\n  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). Accepted formats https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration\n  - `content_matchers` (`list[obj]`): The expected content on the page the check is run against. Currently, only the first entry in the list is supported, and other entries will be ignored. The server will look for an exact match of the string in the page response's content. This field is optional and should only be specified if a content match is required. When `null`, the `content_matchers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.content_matchers.new](#fn-content_matchersnew) constructor.\n  - `http_check` (`list[obj]`): Contains information needed to make an HTTP or HTTPS check. When `null`, the `http_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.new](#fn-http_checknew) constructor.\n  - `monitored_resource` (`list[obj]`): The monitored resource (https://cloud.google.com/monitoring/api/resources) associated with the configuration. The following monitored resource types are supported for uptime checks:  uptime_url  gce_instance  gae_app  aws_ec2_instance aws_elb_load_balancer  k8s_service  servicedirectory_service When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.\n  - `resource_group` (`list[obj]`): The group resource associated with the configuration. When `null`, the `resource_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.resource_group.new](#fn-resource_groupnew) constructor.\n  - `synthetic_monitor` (`list[obj]`): A Synthetic Monitor deployed to a Cloud Functions V2 instance. When `null`, the `synthetic_monitor` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.synthetic_monitor.new](#fn-synthetic_monitornew) constructor.\n  - `tcp_check` (`list[obj]`): Contains information needed to make a TCP check. When `null`, the `tcp_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.new](#fn-tcp_checknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `monitoring_uptime_check_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.monitoring_uptime_check_config.newAttrs` constructs a new object with attributes and blocks configured for the `monitoring_uptime_check_config`\nTerraform resource.\n\nUnlike [google.monitoring_uptime_check_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is 'servicedirectory_service', 'checker_type' must be set to 'VPC_CHECKERS'. Possible values: ["STATIC_IP_CHECKERS", "VPC_CHECKERS"] When `null`, the `checker_type` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the uptime check configuration. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.\n  - `period` (`string`): How often, in seconds, the uptime check is performed. Currently, the only supported values are 60s (1 minute), 300s (5 minutes), 600s (10 minutes), and 900s (15 minutes). Optional, defaults to 300s. When `null`, the `period` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `selected_regions` (`list`): The list of regions from which the check will be run. Some regions contain one location, and others contain more than one. If this field is specified, enough regions to include a minimum of 3 locations must be provided, or an error message is returned. Not specifying this field will result in uptime checks running from all regions. When `null`, the `selected_regions` field will be omitted from the resulting object.\n  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). [See the accepted formats]( https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration)\n  - `user_labels` (`obj`): User-supplied key/value data to be used for organizing and identifying the 'UptimeCheckConfig' objects. The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `content_matchers` (`list[obj]`): The expected content on the page the check is run against. Currently, only the first entry in the list is supported, and other entries will be ignored. The server will look for an exact match of the string in the page response's content. This field is optional and should only be specified if a content match is required. When `null`, the `content_matchers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.content_matchers.new](#fn-content_matchersnew) constructor.\n  - `http_check` (`list[obj]`): Contains information needed to make an HTTP or HTTPS check. When `null`, the `http_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.new](#fn-http_checknew) constructor.\n  - `monitored_resource` (`list[obj]`): The [monitored resource]\n(https://cloud.google.com/monitoring/api/resources) associated with the\nconfiguration. The following monitored resource types are supported for\nuptime checks:\n* 'aws_ec2_instance'\n* 'aws_elb_load_balancer'\n* 'gae_app\n* 'gce_instance'\n* 'k8s_service'\n* 'servicedirectory_service'\n* 'uptime_url' When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.\n  - `resource_group` (`list[obj]`): The group resource associated with the configuration. When `null`, the `resource_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.resource_group.new](#fn-resource_groupnew) constructor.\n  - `synthetic_monitor` (`list[obj]`): A Synthetic Monitor deployed to a Cloud Functions V2 instance. When `null`, the `synthetic_monitor` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.synthetic_monitor.new](#fn-synthetic_monitornew) constructor.\n  - `tcp_check` (`list[obj]`): Contains information needed to make a TCP check. When `null`, the `tcp_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.new](#fn-tcp_checknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `monitoring_uptime_check_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     timeout,
@@ -133,7 +147,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     selected_regions=null,
     synthetic_monitor=null,
     tcp_check=null,
-    timeouts=null
+    timeouts=null,
+    user_labels=null
   ):: std.prune(a={
     checker_type: checker_type,
     content_matchers: content_matchers,
@@ -148,6 +163,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tcp_check: tcp_check,
     timeout: timeout,
     timeouts: timeouts,
+    user_labels: user_labels,
   }),
   resource_group:: {
     '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.resource_group.new` constructs a new object with attributes and blocks configured for the `resource_group`\nTerraform sub block.\n\n\n\n**Args**:\n  - `group_id` (`string`): The group of resources being monitored. Should be the 'name' of a group When `null`, the `group_id` field will be omitted from the resulting object.\n  - `resource_type` (`string`): The resource type of the group members. Possible values: ["RESOURCE_TYPE_UNSPECIFIED", "INSTANCE", "AWS_ELB_LOAD_BALANCER"] When `null`, the `resource_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `resource_group` sub block.\n', args=[]),
@@ -176,12 +192,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   tcp_check:: {
-    '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.tcp_check.new` constructs a new object with attributes and blocks configured for the `tcp_check`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): The port to the page to run the check against. Will be combined with host (specified within the MonitoredResource) to construct the full URL.\n\n**Returns**:\n  - An attribute object that represents the `tcp_check` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.tcp_check.new` constructs a new object with attributes and blocks configured for the `tcp_check`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): The port to the page to run the check against. Will be combined with host (specified within the 'monitored_resource') to construct the full URL.\n  - `ping_config` (`list[obj]`): Contains information needed to add pings to a TCP check. When `null`, the `ping_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.ping_config.new](#fn-tcp_checkping_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `tcp_check` sub block.\n', args=[]),
     new(
-      port
+      port,
+      ping_config=null
     ):: std.prune(a={
+      ping_config: ping_config,
       port: port,
     }),
+    ping_config:: {
+      '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.tcp_check.ping_config.new` constructs a new object with attributes and blocks configured for the `ping_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pings_count` (`number`): Number of ICMP pings. A maximum of 3 ICMP pings is currently supported.\n\n**Returns**:\n  - An attribute object that represents the `ping_config` sub block.\n', args=[]),
+      new(
+        pings_count
+      ):: std.prune(a={
+        pings_count: pings_count,
+      }),
+    },
   },
   timeouts:: {
     '#new':: d.fn(help='\n`google.monitoring_uptime_check_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -395,4 +421,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withUserLabels':: d.fn(help='`google.obj.withUserLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the user_labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `user_labels` field.\n', args=[]),
+  withUserLabels(resourceLabel, value): {
+    resource+: {
+      google_monitoring_uptime_check_config+: {
+        [resourceLabel]+: {
+          user_labels: value,
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/netapp_active_directory.libsonnet b/4.x/_gen/resources/netapp_active_directory.libsonnet
new file mode 100644
index 00000000..fc331cba
--- /dev/null
+++ b/4.x/_gen/resources/netapp_active_directory.libsonnet
@@ -0,0 +1,336 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='netapp_active_directory', url='', help='`netapp_active_directory` represents the `google_netapp_active_directory` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.netapp_active_directory.new` injects a new `google_netapp_active_directory` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_active_directory.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_active_directory` using the reference:\n\n    $._ref.google_netapp_active_directory.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_active_directory.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `aes_encryption` (`bool`): Enables AES-128 and AES-256 encryption for Kerberos-based communication with Active Directory. When `null`, the `aes_encryption` field will be omitted from the resulting object.\n  - `backup_operators` (`list`): Domain user/group accounts to be added to the Backup Operators group of the SMB service. The Backup Operators group allows members to backup and restore files regardless of whether they have read or write access to the files. Comma-separated list. When `null`, the `backup_operators` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns` (`string`): Comma separated list of DNS server IP addresses for the Active Directory domain.\n  - `domain` (`string`): Fully qualified domain name for the Active Directory domain.\n  - `encrypt_dc_connections` (`bool`): If enabled, traffic between the SMB server to Domain Controller (DC) will be encrypted. When `null`, the `encrypt_dc_connections` field will be omitted from the resulting object.\n  - `kdc_hostname` (`string`): Hostname of the Active Directory server used as Kerberos Key Distribution Center. Only requried for volumes using kerberized NFSv4.1 When `null`, the `kdc_hostname` field will be omitted from the resulting object.\n  - `kdc_ip` (`string`): IP address of the Active Directory server used as Kerberos Key Distribution Center. When `null`, the `kdc_ip` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `ldap_signing` (`bool`): Specifies whether or not the LDAP traffic needs to be signed. When `null`, the `ldap_signing` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the region for the policy to apply to.\n  - `name` (`string`): The resource name of the Active Directory pool. Needs to be unique per location.\n  - `net_bios_prefix` (`string`): NetBIOS name prefix of the server to be created.\nA five-character random ID is generated automatically, for example, -6f9a, and appended to the prefix. The full UNC share path will have the following format:\n\u0026#39;\\\\NetBIOS_PREFIX-ABCD.DOMAIN_NAME\\SHARE_NAME\u0026#39;\n  - `nfs_users_with_ldap` (`bool`): Local UNIX users on clients without valid user information in Active Directory are blocked from access to LDAP enabled volumes.\nThis option can be used to temporarily switch such volumes to AUTH_SYS authentication (user ID \u0026#43; 1-16 groups). When `null`, the `nfs_users_with_ldap` field will be omitted from the resulting object.\n  - `organizational_unit` (`string`): Name of the Organizational Unit where you intend to create the computer account for NetApp Volumes.\nDefaults to \u0026#39;CN=Computers\u0026#39; if left empty. When `null`, the `organizational_unit` field will be omitted from the resulting object.\n  - `password` (`string`): Password for specified username. Note - Manual changes done to the password will not be detected. Terraform will not re-apply the password, unless you use a new password in Terraform.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_operators` (`list`): Domain accounts that require elevated privileges such as \u0026#39;SeSecurityPrivilege\u0026#39; to manage security logs. Comma-separated list. When `null`, the `security_operators` field will be omitted from the resulting object.\n  - `site` (`string`): Specifies an Active Directory site to manage domain controller selection.\nUse when Active Directory domain controllers in multiple regions are configured. Defaults to \u0026#39;Default-First-Site-Name\u0026#39; if left empty. When `null`, the `site` field will be omitted from the resulting object.\n  - `username` (`string`): Username for the Active Directory account with permissions to create the compute account within the specified organizational unit.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_active_directory.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    dns,
+    domain,
+    location,
+    name,
+    net_bios_prefix,
+    password,
+    username,
+    aes_encryption=null,
+    backup_operators=null,
+    description=null,
+    encrypt_dc_connections=null,
+    kdc_hostname=null,
+    kdc_ip=null,
+    labels=null,
+    ldap_signing=null,
+    nfs_users_with_ldap=null,
+    organizational_unit=null,
+    project=null,
+    security_operators=null,
+    site=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_netapp_active_directory',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      aes_encryption=aes_encryption,
+      backup_operators=backup_operators,
+      description=description,
+      dns=dns,
+      domain=domain,
+      encrypt_dc_connections=encrypt_dc_connections,
+      kdc_hostname=kdc_hostname,
+      kdc_ip=kdc_ip,
+      labels=labels,
+      ldap_signing=ldap_signing,
+      location=location,
+      name=name,
+      net_bios_prefix=net_bios_prefix,
+      nfs_users_with_ldap=nfs_users_with_ldap,
+      organizational_unit=organizational_unit,
+      password=password,
+      project=project,
+      security_operators=security_operators,
+      site=site,
+      timeouts=timeouts,
+      username=username
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.netapp_active_directory.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_active_directory`\nTerraform resource.\n\nUnlike [google.netapp_active_directory.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `aes_encryption` (`bool`): Enables AES-128 and AES-256 encryption for Kerberos-based communication with Active Directory. When `null`, the `aes_encryption` field will be omitted from the resulting object.\n  - `backup_operators` (`list`): Domain user/group accounts to be added to the Backup Operators group of the SMB service. The Backup Operators group allows members to backup and restore files regardless of whether they have read or write access to the files. Comma-separated list. When `null`, the `backup_operators` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns` (`string`): Comma separated list of DNS server IP addresses for the Active Directory domain.\n  - `domain` (`string`): Fully qualified domain name for the Active Directory domain.\n  - `encrypt_dc_connections` (`bool`): If enabled, traffic between the SMB server to Domain Controller (DC) will be encrypted. When `null`, the `encrypt_dc_connections` field will be omitted from the resulting object.\n  - `kdc_hostname` (`string`): Hostname of the Active Directory server used as Kerberos Key Distribution Center. Only requried for volumes using kerberized NFSv4.1 When `null`, the `kdc_hostname` field will be omitted from the resulting object.\n  - `kdc_ip` (`string`): IP address of the Active Directory server used as Kerberos Key Distribution Center. When `null`, the `kdc_ip` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `ldap_signing` (`bool`): Specifies whether or not the LDAP traffic needs to be signed. When `null`, the `ldap_signing` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the region for the policy to apply to.\n  - `name` (`string`): The resource name of the Active Directory pool. Needs to be unique per location.\n  - `net_bios_prefix` (`string`): NetBIOS name prefix of the server to be created.\nA five-character random ID is generated automatically, for example, -6f9a, and appended to the prefix. The full UNC share path will have the following format:\n'\\\\NetBIOS_PREFIX-ABCD.DOMAIN_NAME\\SHARE_NAME'\n  - `nfs_users_with_ldap` (`bool`): Local UNIX users on clients without valid user information in Active Directory are blocked from access to LDAP enabled volumes.\nThis option can be used to temporarily switch such volumes to AUTH_SYS authentication (user ID + 1-16 groups). When `null`, the `nfs_users_with_ldap` field will be omitted from the resulting object.\n  - `organizational_unit` (`string`): Name of the Organizational Unit where you intend to create the computer account for NetApp Volumes.\nDefaults to 'CN=Computers' if left empty. When `null`, the `organizational_unit` field will be omitted from the resulting object.\n  - `password` (`string`): Password for specified username. Note - Manual changes done to the password will not be detected. Terraform will not re-apply the password, unless you use a new password in Terraform.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_operators` (`list`): Domain accounts that require elevated privileges such as 'SeSecurityPrivilege' to manage security logs. Comma-separated list. When `null`, the `security_operators` field will be omitted from the resulting object.\n  - `site` (`string`): Specifies an Active Directory site to manage domain controller selection.\nUse when Active Directory domain controllers in multiple regions are configured. Defaults to 'Default-First-Site-Name' if left empty. When `null`, the `site` field will be omitted from the resulting object.\n  - `username` (`string`): Username for the Active Directory account with permissions to create the compute account within the specified organizational unit.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_active_directory.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_active_directory` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    dns,
+    domain,
+    location,
+    name,
+    net_bios_prefix,
+    password,
+    username,
+    aes_encryption=null,
+    backup_operators=null,
+    description=null,
+    encrypt_dc_connections=null,
+    kdc_hostname=null,
+    kdc_ip=null,
+    labels=null,
+    ldap_signing=null,
+    nfs_users_with_ldap=null,
+    organizational_unit=null,
+    project=null,
+    security_operators=null,
+    site=null,
+    timeouts=null
+  ):: std.prune(a={
+    aes_encryption: aes_encryption,
+    backup_operators: backup_operators,
+    description: description,
+    dns: dns,
+    domain: domain,
+    encrypt_dc_connections: encrypt_dc_connections,
+    kdc_hostname: kdc_hostname,
+    kdc_ip: kdc_ip,
+    labels: labels,
+    ldap_signing: ldap_signing,
+    location: location,
+    name: name,
+    net_bios_prefix: net_bios_prefix,
+    nfs_users_with_ldap: nfs_users_with_ldap,
+    organizational_unit: organizational_unit,
+    password: password,
+    project: project,
+    security_operators: security_operators,
+    site: site,
+    timeouts: timeouts,
+    username: username,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.netapp_active_directory.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAesEncryption':: d.fn(help='`google.bool.withAesEncryption` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the aes_encryption field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `aes_encryption` field.\n', args=[]),
+  withAesEncryption(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          aes_encryption: value,
+        },
+      },
+    },
+  },
+  '#withBackupOperators':: d.fn(help='`google.list.withBackupOperators` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the backup_operators field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `backup_operators` field.\n', args=[]),
+  withBackupOperators(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          backup_operators: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDns':: d.fn(help='`google.string.withDns` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the dns field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `dns` field.\n', args=[]),
+  withDns(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          dns: value,
+        },
+      },
+    },
+  },
+  '#withDomain':: d.fn(help='`google.string.withDomain` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the domain field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `domain` field.\n', args=[]),
+  withDomain(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          domain: value,
+        },
+      },
+    },
+  },
+  '#withEncryptDcConnections':: d.fn(help='`google.bool.withEncryptDcConnections` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the encrypt_dc_connections field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `encrypt_dc_connections` field.\n', args=[]),
+  withEncryptDcConnections(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          encrypt_dc_connections: value,
+        },
+      },
+    },
+  },
+  '#withKdcHostname':: d.fn(help='`google.string.withKdcHostname` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kdc_hostname field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kdc_hostname` field.\n', args=[]),
+  withKdcHostname(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          kdc_hostname: value,
+        },
+      },
+    },
+  },
+  '#withKdcIp':: d.fn(help='`google.string.withKdcIp` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kdc_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kdc_ip` field.\n', args=[]),
+  withKdcIp(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          kdc_ip: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLdapSigning':: d.fn(help='`google.bool.withLdapSigning` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the ldap_signing field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `ldap_signing` field.\n', args=[]),
+  withLdapSigning(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          ldap_signing: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetBiosPrefix':: d.fn(help='`google.string.withNetBiosPrefix` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the net_bios_prefix field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `net_bios_prefix` field.\n', args=[]),
+  withNetBiosPrefix(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          net_bios_prefix: value,
+        },
+      },
+    },
+  },
+  '#withNfsUsersWithLdap':: d.fn(help='`google.bool.withNfsUsersWithLdap` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the nfs_users_with_ldap field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `nfs_users_with_ldap` field.\n', args=[]),
+  withNfsUsersWithLdap(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          nfs_users_with_ldap: value,
+        },
+      },
+    },
+  },
+  '#withOrganizationalUnit':: d.fn(help='`google.string.withOrganizationalUnit` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the organizational_unit field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `organizational_unit` field.\n', args=[]),
+  withOrganizationalUnit(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          organizational_unit: value,
+        },
+      },
+    },
+  },
+  '#withPassword':: d.fn(help='`google.string.withPassword` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the password field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `password` field.\n', args=[]),
+  withPassword(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          password: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSecurityOperators':: d.fn(help='`google.list.withSecurityOperators` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the security_operators field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `security_operators` field.\n', args=[]),
+  withSecurityOperators(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          security_operators: value,
+        },
+      },
+    },
+  },
+  '#withSite':: d.fn(help='`google.string.withSite` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the site field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `site` field.\n', args=[]),
+  withSite(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          site: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUsername':: d.fn(help='`google.string.withUsername` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the username field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `username` field.\n', args=[]),
+  withUsername(resourceLabel, value): {
+    resource+: {
+      google_netapp_active_directory+: {
+        [resourceLabel]+: {
+          username: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/netapp_backup_policy.libsonnet b/4.x/_gen/resources/netapp_backup_policy.libsonnet
new file mode 100644
index 00000000..81637010
--- /dev/null
+++ b/4.x/_gen/resources/netapp_backup_policy.libsonnet
@@ -0,0 +1,182 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='netapp_backup_policy', url='', help='`netapp_backup_policy` represents the `google_netapp_backup_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.netapp_backup_policy.new` injects a new `google_netapp_backup_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_backup_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_backup_policy` using the reference:\n\n    $._ref.google_netapp_backup_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_backup_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `daily_backup_limit` (`number`): Number of daily backups to keep. Note that the minimum daily backup limit is 2.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `enabled` (`bool`): If enabled, make backups automatically according to the schedules.\nThis will be applied to all volumes that have this policy attached and enforced on volume level. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the region for the policy to apply to.\n  - `monthly_backup_limit` (`number`): Number of monthly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.\n  - `name` (`string`): The name of the backup policy. Needs to be unique per location.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `weekly_backup_limit` (`number`): Number of weekly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    daily_backup_limit,
+    location,
+    monthly_backup_limit,
+    name,
+    weekly_backup_limit,
+    description=null,
+    enabled=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_netapp_backup_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      daily_backup_limit=daily_backup_limit,
+      description=description,
+      enabled=enabled,
+      labels=labels,
+      location=location,
+      monthly_backup_limit=monthly_backup_limit,
+      name=name,
+      project=project,
+      timeouts=timeouts,
+      weekly_backup_limit=weekly_backup_limit
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.netapp_backup_policy.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_backup_policy`\nTerraform resource.\n\nUnlike [google.netapp_backup_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `daily_backup_limit` (`number`): Number of daily backups to keep. Note that the minimum daily backup limit is 2.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `enabled` (`bool`): If enabled, make backups automatically according to the schedules.\nThis will be applied to all volumes that have this policy attached and enforced on volume level. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the region for the policy to apply to.\n  - `monthly_backup_limit` (`number`): Number of monthly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.\n  - `name` (`string`): The name of the backup policy. Needs to be unique per location.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `weekly_backup_limit` (`number`): Number of weekly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_backup_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    daily_backup_limit,
+    location,
+    monthly_backup_limit,
+    name,
+    weekly_backup_limit,
+    description=null,
+    enabled=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    daily_backup_limit: daily_backup_limit,
+    description: description,
+    enabled: enabled,
+    labels: labels,
+    location: location,
+    monthly_backup_limit: monthly_backup_limit,
+    name: name,
+    project: project,
+    timeouts: timeouts,
+    weekly_backup_limit: weekly_backup_limit,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.netapp_backup_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDailyBackupLimit':: d.fn(help='`google.number.withDailyBackupLimit` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the daily_backup_limit field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `daily_backup_limit` field.\n', args=[]),
+  withDailyBackupLimit(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          daily_backup_limit: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withEnabled':: d.fn(help='`google.bool.withEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enabled` field.\n', args=[]),
+  withEnabled(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          enabled: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMonthlyBackupLimit':: d.fn(help='`google.number.withMonthlyBackupLimit` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the monthly_backup_limit field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `monthly_backup_limit` field.\n', args=[]),
+  withMonthlyBackupLimit(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          monthly_backup_limit: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withWeeklyBackupLimit':: d.fn(help='`google.number.withWeeklyBackupLimit` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the weekly_backup_limit field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `weekly_backup_limit` field.\n', args=[]),
+  withWeeklyBackupLimit(resourceLabel, value): {
+    resource+: {
+      google_netapp_backup_policy+: {
+        [resourceLabel]+: {
+          weekly_backup_limit: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/game_services_realm.libsonnet b/4.x/_gen/resources/netapp_backup_vault.libsonnet
similarity index 55%
rename from 4.x/_gen/resources/game_services_realm.libsonnet
rename to 4.x/_gen/resources/netapp_backup_vault.libsonnet
index 84066d07..78c7dcec 100644
--- a/4.x/_gen/resources/game_services_realm.libsonnet
+++ b/4.x/_gen/resources/netapp_backup_vault.libsonnet
@@ -1,52 +1,48 @@
 local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
-  '#':: d.pkg(name='game_services_realm', url='', help='`game_services_realm` represents the `google_game_services_realm` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.game_services_realm.new` injects a new `google_game_services_realm` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_realm.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_realm` using the reference:\n\n    $._ref.google_game_services_realm.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_realm.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): GCP region of the Realm.\n  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of\nthis field must be from the IANA time zone database:\nhttps://www.iana.org/time-zones.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#':: d.pkg(name='netapp_backup_vault', url='', help='`netapp_backup_vault` represents the `google_netapp_backup_vault` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.netapp_backup_vault.new` injects a new `google_netapp_backup_vault` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_backup_vault.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_backup_vault` using the reference:\n\n    $._ref.google_netapp_backup_vault.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_backup_vault.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location (region) of the backup vault.\n  - `name` (`string`): The resource name of the backup vault. Needs to be unique per location.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_vault.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
-    realm_id,
-    time_zone,
+    location,
+    name,
     description=null,
     labels=null,
-    location=null,
     project=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
-    type='google_game_services_realm',
+    type='google_netapp_backup_vault',
     label=resourceLabel,
     attrs=self.newAttrs(
       description=description,
       labels=labels,
       location=location,
+      name=name,
       project=project,
-      realm_id=realm_id,
-      time_zone=time_zone,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_realm.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_realm`\nTerraform resource.\n\nUnlike [google.game_services_realm.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): GCP region of the Realm.\n  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of\nthis field must be from the IANA time zone database:\nhttps://www.iana.org/time-zones.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_realm` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.netapp_backup_vault.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_backup_vault`\nTerraform resource.\n\nUnlike [google.netapp_backup_vault.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location (region) of the backup vault.\n  - `name` (`string`): The resource name of the backup vault. Needs to be unique per location.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_vault.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_backup_vault` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
-    realm_id,
-    time_zone,
+    location,
+    name,
     description=null,
     labels=null,
-    location=null,
     project=null,
     timeouts=null
   ):: std.prune(a={
     description: description,
     labels: labels,
     location: location,
+    name: name,
     project: project,
-    realm_id: realm_id,
-    time_zone: time_zone,
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_realm.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.netapp_backup_vault.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
       delete=null,
@@ -60,7 +56,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
           description: value,
         },
@@ -70,7 +66,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
   withLabels(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
           labels: value,
         },
@@ -80,39 +76,29 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
           location: value,
         },
       },
     },
   },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRealmId':: d.fn(help='`google.string.withRealmId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the realm_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `realm_id` field.\n', args=[]),
-  withRealmId(resourceLabel, value): {
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
-          realm_id: value,
+          name: value,
         },
       },
     },
   },
-  '#withTimeZone':: d.fn(help='`google.string.withTimeZone` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the time_zone field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `time_zone` field.\n', args=[]),
-  withTimeZone(resourceLabel, value): {
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
-          time_zone: value,
+          project: value,
         },
       },
     },
@@ -120,7 +106,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
           timeouts: value,
         },
@@ -130,7 +116,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeoutsMixin(resourceLabel, value): {
     resource+: {
-      google_game_services_realm+: {
+      google_netapp_backup_vault+: {
         [resourceLabel]+: {
           timeouts+: value,
         },
diff --git a/4.x/_gen/resources/netapp_kmsconfig.libsonnet b/4.x/_gen/resources/netapp_kmsconfig.libsonnet
new file mode 100644
index 00000000..cc5f7809
--- /dev/null
+++ b/4.x/_gen/resources/netapp_kmsconfig.libsonnet
@@ -0,0 +1,140 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='netapp_kmsconfig', url='', help='`netapp_kmsconfig` represents the `google_netapp_kmsconfig` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.netapp_kmsconfig.new` injects a new `google_netapp_kmsconfig` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_kmsconfig.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_kmsconfig` using the reference:\n\n    $._ref.google_netapp_kmsconfig.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_kmsconfig.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `crypto_key_name` (`string`): Resource name of the KMS key to use. Only regional keys are supported. Format: \u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{key_ring}}/cryptoKeys/{{key}}\u0026#39;.\n  - `description` (`string`): Description for the CMEK policy. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the policy location. CMEK policies apply to the whole region.\n  - `name` (`string`): Name of the CMEK policy.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_kmsconfig.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    crypto_key_name,
+    location,
+    name,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_netapp_kmsconfig',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      crypto_key_name=crypto_key_name,
+      description=description,
+      labels=labels,
+      location=location,
+      name=name,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.netapp_kmsconfig.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_kmsconfig`\nTerraform resource.\n\nUnlike [google.netapp_kmsconfig.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `crypto_key_name` (`string`): Resource name of the KMS key to use. Only regional keys are supported. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{key_ring}}/cryptoKeys/{{key}}'.\n  - `description` (`string`): Description for the CMEK policy. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the policy location. CMEK policies apply to the whole region.\n  - `name` (`string`): Name of the CMEK policy.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_kmsconfig.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_kmsconfig` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    crypto_key_name,
+    location,
+    name,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    crypto_key_name: crypto_key_name,
+    description: description,
+    labels: labels,
+    location: location,
+    name: name,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.netapp_kmsconfig.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCryptoKeyName':: d.fn(help='`google.string.withCryptoKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the crypto_key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `crypto_key_name` field.\n', args=[]),
+  withCryptoKeyName(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          crypto_key_name: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_kmsconfig+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/netapp_storage_pool.libsonnet b/4.x/_gen/resources/netapp_storage_pool.libsonnet
new file mode 100644
index 00000000..9a700e35
--- /dev/null
+++ b/4.x/_gen/resources/netapp_storage_pool.libsonnet
@@ -0,0 +1,210 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='netapp_storage_pool', url='', help='`netapp_storage_pool` represents the `google_netapp_storage_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.netapp_storage_pool.new` injects a new `google_netapp_storage_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_storage_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_storage_pool` using the reference:\n\n    $._ref.google_netapp_storage_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_storage_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `active_directory` (`string`): Specifies the Active Directory policy to be used. Format: \u0026#39;projects/{{project}}/locations/{{location}}/activeDirectories/{{name}}\u0026#39;.\nThe policy needs to be in the same location as the storage pool. When `null`, the `active_directory` field will be omitted from the resulting object.\n  - `capacity_gib` (`string`): Capacity of the storage pool (in GiB).\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_config` (`string`): Specifies the CMEK policy to be used for volume encryption. Format: \u0026#39;projects/{{project}}/locations/{{location}}/kmsConfigs/{{name}}\u0026#39;.\nThe policy needs to be in the same location as the storage pool. When `null`, the `kms_config` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `ldap_enabled` (`bool`): When enabled, the volumes uses Active Directory as LDAP name service for UID/GID lookups. Required to enable extended group support for NFSv3,\nusing security identifiers for NFSv4.1 or principal names for kerberized NFSv4.1. When `null`, the `ldap_enabled` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the location. Usually a region name, expect for some STANDARD service level pools which require a zone name.\n  - `name` (`string`): The resource name of the storage pool. Needs to be unique per location.\n  - `network` (`string`): VPC network name with format: \u0026#39;projects/{{project}}/global/networks/{{network}}\u0026#39;\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_level` (`string`): Service level of the storage pool. Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;EXTREME\u0026#34;, \u0026#34;STANDARD\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_storage_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    capacity_gib,
+    location,
+    name,
+    network,
+    service_level,
+    active_directory=null,
+    description=null,
+    kms_config=null,
+    labels=null,
+    ldap_enabled=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_netapp_storage_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      active_directory=active_directory,
+      capacity_gib=capacity_gib,
+      description=description,
+      kms_config=kms_config,
+      labels=labels,
+      ldap_enabled=ldap_enabled,
+      location=location,
+      name=name,
+      network=network,
+      project=project,
+      service_level=service_level,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.netapp_storage_pool.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_storage_pool`\nTerraform resource.\n\nUnlike [google.netapp_storage_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `active_directory` (`string`): Specifies the Active Directory policy to be used. Format: 'projects/{{project}}/locations/{{location}}/activeDirectories/{{name}}'.\nThe policy needs to be in the same location as the storage pool. When `null`, the `active_directory` field will be omitted from the resulting object.\n  - `capacity_gib` (`string`): Capacity of the storage pool (in GiB).\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_config` (`string`): Specifies the CMEK policy to be used for volume encryption. Format: 'projects/{{project}}/locations/{{location}}/kmsConfigs/{{name}}'.\nThe policy needs to be in the same location as the storage pool. When `null`, the `kms_config` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `ldap_enabled` (`bool`): When enabled, the volumes uses Active Directory as LDAP name service for UID/GID lookups. Required to enable extended group support for NFSv3,\nusing security identifiers for NFSv4.1 or principal names for kerberized NFSv4.1. When `null`, the `ldap_enabled` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the location. Usually a region name, expect for some STANDARD service level pools which require a zone name.\n  - `name` (`string`): The resource name of the storage pool. Needs to be unique per location.\n  - `network` (`string`): VPC network name with format: 'projects/{{project}}/global/networks/{{network}}'\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_level` (`string`): Service level of the storage pool. Possible values: ["PREMIUM", "EXTREME", "STANDARD"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_storage_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_storage_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    capacity_gib,
+    location,
+    name,
+    network,
+    service_level,
+    active_directory=null,
+    description=null,
+    kms_config=null,
+    labels=null,
+    ldap_enabled=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    active_directory: active_directory,
+    capacity_gib: capacity_gib,
+    description: description,
+    kms_config: kms_config,
+    labels: labels,
+    ldap_enabled: ldap_enabled,
+    location: location,
+    name: name,
+    network: network,
+    project: project,
+    service_level: service_level,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.netapp_storage_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withActiveDirectory':: d.fn(help='`google.string.withActiveDirectory` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the active_directory field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `active_directory` field.\n', args=[]),
+  withActiveDirectory(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          active_directory: value,
+        },
+      },
+    },
+  },
+  '#withCapacityGib':: d.fn(help='`google.string.withCapacityGib` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the capacity_gib field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `capacity_gib` field.\n', args=[]),
+  withCapacityGib(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          capacity_gib: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withKmsConfig':: d.fn(help='`google.string.withKmsConfig` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kms_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kms_config` field.\n', args=[]),
+  withKmsConfig(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          kms_config: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLdapEnabled':: d.fn(help='`google.bool.withLdapEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the ldap_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `ldap_enabled` field.\n', args=[]),
+  withLdapEnabled(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          ldap_enabled: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetwork':: d.fn(help='`google.string.withNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `network` field.\n', args=[]),
+  withNetwork(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          network: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withServiceLevel':: d.fn(help='`google.string.withServiceLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_level` field.\n', args=[]),
+  withServiceLevel(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          service_level: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_storage_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/netapp_volume.libsonnet b/4.x/_gen/resources/netapp_volume.libsonnet
new file mode 100644
index 00000000..87903752
--- /dev/null
+++ b/4.x/_gen/resources/netapp_volume.libsonnet
@@ -0,0 +1,430 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='netapp_volume', url='', help='`netapp_volume` represents the `google_netapp_volume` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  export_policy:: {
+    '#new':: d.fn(help='\n`google.netapp_volume.export_policy.new` constructs a new object with attributes and blocks configured for the `export_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `rules` (`list[obj]`): Export rules (up to 5) control NFS volume access. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.export_policy.rules.new](#fn-export_policyrulesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `export_policy` sub block.\n', args=[]),
+    new(
+      rules=null
+    ):: std.prune(a={
+      rules: rules,
+    }),
+    rules:: {
+      '#new':: d.fn(help='\n`google.netapp_volume.export_policy.rules.new` constructs a new object with attributes and blocks configured for the `rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_type` (`string`): Defines the access type for clients matching the 'allowedClients' specification. Possible values: ["READ_ONLY", "READ_WRITE", "READ_NONE"] When `null`, the `access_type` field will be omitted from the resulting object.\n  - `allowed_clients` (`string`): Defines the client ingress specification (allowed clients) as a comma seperated list with IPv4 CIDRs or IPv4 host addresses. When `null`, the `allowed_clients` field will be omitted from the resulting object.\n  - `has_root_access` (`string`): If enabled, the root user (UID = 0) of the specified clients doesn't get mapped to nobody (UID = 65534). This is also known as no_root_squash. When `null`, the `has_root_access` field will be omitted from the resulting object.\n  - `kerberos5_read_only` (`bool`): If enabled (true) the rule defines a read only access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'authentication' kerberos security mode. When `null`, the `kerberos5_read_only` field will be omitted from the resulting object.\n  - `kerberos5_read_write` (`bool`): If enabled (true) the rule defines read and write access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'authentication' kerberos security mode. The 'kerberos5ReadOnly' value is ignored if this is enabled. When `null`, the `kerberos5_read_write` field will be omitted from the resulting object.\n  - `kerberos5i_read_only` (`bool`): If enabled (true) the rule defines a read only access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'integrity' kerberos security mode. When `null`, the `kerberos5i_read_only` field will be omitted from the resulting object.\n  - `kerberos5i_read_write` (`bool`): If enabled (true) the rule defines read and write access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'integrity' kerberos security mode. The 'kerberos5iReadOnly' value is ignored if this is enabled. When `null`, the `kerberos5i_read_write` field will be omitted from the resulting object.\n  - `kerberos5p_read_only` (`bool`): If enabled (true) the rule defines a read only access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'privacy' kerberos security mode. When `null`, the `kerberos5p_read_only` field will be omitted from the resulting object.\n  - `kerberos5p_read_write` (`bool`): If enabled (true) the rule defines read and write access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'privacy' kerberos security mode. The 'kerberos5pReadOnly' value is ignored if this is enabled. When `null`, the `kerberos5p_read_write` field will be omitted from the resulting object.\n  - `nfsv3` (`bool`): Enable to apply the export rule to NFSV3 clients. When `null`, the `nfsv3` field will be omitted from the resulting object.\n  - `nfsv4` (`bool`): Enable to apply the export rule to NFSV4.1 clients. When `null`, the `nfsv4` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `rules` sub block.\n', args=[]),
+      new(
+        access_type=null,
+        allowed_clients=null,
+        has_root_access=null,
+        kerberos5_read_only=null,
+        kerberos5_read_write=null,
+        kerberos5i_read_only=null,
+        kerberos5i_read_write=null,
+        kerberos5p_read_only=null,
+        kerberos5p_read_write=null,
+        nfsv3=null,
+        nfsv4=null
+      ):: std.prune(a={
+        access_type: access_type,
+        allowed_clients: allowed_clients,
+        has_root_access: has_root_access,
+        kerberos5_read_only: kerberos5_read_only,
+        kerberos5_read_write: kerberos5_read_write,
+        kerberos5i_read_only: kerberos5i_read_only,
+        kerberos5i_read_write: kerberos5i_read_write,
+        kerberos5p_read_only: kerberos5p_read_only,
+        kerberos5p_read_write: kerberos5p_read_write,
+        nfsv3: nfsv3,
+        nfsv4: nfsv4,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.netapp_volume.new` injects a new `google_netapp_volume` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_volume.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_volume` using the reference:\n\n    $._ref.google_netapp_volume.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_volume.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity_gib` (`string`): Capacity of the volume (in GiB).\n  - `deletion_policy` (`string`): Policy to determine if the volume should be deleted forcefully.\nVolumes may have nested snapshot resources. Deleting such a volume will fail.\nSetting this parameter to FORCE will delete volumes including nested snapshots. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `kerberos_enabled` (`bool`): Flag indicating if the volume is a kerberos volume or not, export policy rules control kerberos security modes (krb5, krb5i, krb5p). When `null`, the `kerberos_enabled` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the pool location. Usually a region name, expect for some STANDARD service level pools which require a zone name.\n  - `name` (`string`): The name of the volume. Needs to be unique per location.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocols` (`list`): The protocol of the volume. Allowed combinations are \u0026#39;[\u0026#39;NFSV3\u0026#39;]\u0026#39;, \u0026#39;[\u0026#39;NFSV4\u0026#39;]\u0026#39;, \u0026#39;[\u0026#39;SMB\u0026#39;]\u0026#39;, \u0026#39;[\u0026#39;NFSV3\u0026#39;, \u0026#39;NFSV4\u0026#39;]\u0026#39;, \u0026#39;[\u0026#39;SMB\u0026#39;, \u0026#39;NFSV3\u0026#39;]\u0026#39; and \u0026#39;[\u0026#39;SMB\u0026#39;, \u0026#39;NFSV4\u0026#39;]\u0026#39;. Possible values: [\u0026#34;NFSV3\u0026#34;, \u0026#34;NFSV4\u0026#34;, \u0026#34;SMB\u0026#34;]\n  - `restricted_actions` (`list`): List of actions that are restricted on this volume. Possible values: [\u0026#34;DELETE\u0026#34;] When `null`, the `restricted_actions` field will be omitted from the resulting object.\n  - `security_style` (`string`): Security Style of the Volume. Use UNIX to use UNIX or NFSV4 ACLs for file permissions.\nUse NTFS to use NTFS ACLs for file permissions. Can only be set for volumes which use SMB together with NFS as protocol. Possible values: [\u0026#34;NTFS\u0026#34;, \u0026#34;UNIX\u0026#34;] When `null`, the `security_style` field will be omitted from the resulting object.\n  - `share_name` (`string`): Share name (SMB) or export path (NFS) of the volume. Needs to be unique per location.\n  - `smb_settings` (`list`): Settings for volumes with SMB access. Possible values: [\u0026#34;ENCRYPT_DATA\u0026#34;, \u0026#34;BROWSABLE\u0026#34;, \u0026#34;CHANGE_NOTIFY\u0026#34;, \u0026#34;NON_BROWSABLE\u0026#34;, \u0026#34;OPLOCKS\u0026#34;, \u0026#34;SHOW_SNAPSHOT\u0026#34;, \u0026#34;SHOW_PREVIOUS_VERSIONS\u0026#34;, \u0026#34;ACCESS_BASED_ENUMERATION\u0026#34;, \u0026#34;CONTINUOUSLY_AVAILABLE\u0026#34;] When `null`, the `smb_settings` field will be omitted from the resulting object.\n  - `snapshot_directory` (`bool`): If enabled, a NFS volume will contain a read-only .snapshot directory which provides access to each of the volume\u0026#39;s snapshots. Will enable \u0026#34;Previous Versions\u0026#34; support for SMB. When `null`, the `snapshot_directory` field will be omitted from the resulting object.\n  - `storage_pool` (`string`): Name of the storage pool to create the volume in. Pool needs enough spare capacity to accomodate the volume.\n  - `unix_permissions` (`string`): Unix permission the mount point will be created with. Default is 0770. Applicable for UNIX security style volumes only. When `null`, the `unix_permissions` field will be omitted from the resulting object.\n  - `export_policy` (`list[obj]`): Export policy of the volume for NFSV3 and/or NFSV4.1 access. When `null`, the `export_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.export_policy.new](#fn-export_policynew) constructor.\n  - `snapshot_policy` (`list[obj]`): Snapshot policy defines the schedule for automatic snapshot creation.\nTo disable automatic snapshot creation you have to remove the whole snapshot_policy block. When `null`, the `snapshot_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.new](#fn-snapshot_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    capacity_gib,
+    location,
+    name,
+    protocols,
+    share_name,
+    storage_pool,
+    deletion_policy=null,
+    description=null,
+    export_policy=null,
+    kerberos_enabled=null,
+    labels=null,
+    project=null,
+    restricted_actions=null,
+    security_style=null,
+    smb_settings=null,
+    snapshot_directory=null,
+    snapshot_policy=null,
+    timeouts=null,
+    unix_permissions=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_netapp_volume',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      capacity_gib=capacity_gib,
+      deletion_policy=deletion_policy,
+      description=description,
+      export_policy=export_policy,
+      kerberos_enabled=kerberos_enabled,
+      labels=labels,
+      location=location,
+      name=name,
+      project=project,
+      protocols=protocols,
+      restricted_actions=restricted_actions,
+      security_style=security_style,
+      share_name=share_name,
+      smb_settings=smb_settings,
+      snapshot_directory=snapshot_directory,
+      snapshot_policy=snapshot_policy,
+      storage_pool=storage_pool,
+      timeouts=timeouts,
+      unix_permissions=unix_permissions
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.netapp_volume.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_volume`\nTerraform resource.\n\nUnlike [google.netapp_volume.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity_gib` (`string`): Capacity of the volume (in GiB).\n  - `deletion_policy` (`string`): Policy to determine if the volume should be deleted forcefully.\nVolumes may have nested snapshot resources. Deleting such a volume will fail.\nSetting this parameter to FORCE will delete volumes including nested snapshots. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `kerberos_enabled` (`bool`): Flag indicating if the volume is a kerberos volume or not, export policy rules control kerberos security modes (krb5, krb5i, krb5p). When `null`, the `kerberos_enabled` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the pool location. Usually a region name, expect for some STANDARD service level pools which require a zone name.\n  - `name` (`string`): The name of the volume. Needs to be unique per location.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocols` (`list`): The protocol of the volume. Allowed combinations are '['NFSV3']', '['NFSV4']', '['SMB']', '['NFSV3', 'NFSV4']', '['SMB', 'NFSV3']' and '['SMB', 'NFSV4']'. Possible values: ["NFSV3", "NFSV4", "SMB"]\n  - `restricted_actions` (`list`): List of actions that are restricted on this volume. Possible values: ["DELETE"] When `null`, the `restricted_actions` field will be omitted from the resulting object.\n  - `security_style` (`string`): Security Style of the Volume. Use UNIX to use UNIX or NFSV4 ACLs for file permissions.\nUse NTFS to use NTFS ACLs for file permissions. Can only be set for volumes which use SMB together with NFS as protocol. Possible values: ["NTFS", "UNIX"] When `null`, the `security_style` field will be omitted from the resulting object.\n  - `share_name` (`string`): Share name (SMB) or export path (NFS) of the volume. Needs to be unique per location.\n  - `smb_settings` (`list`): Settings for volumes with SMB access. Possible values: ["ENCRYPT_DATA", "BROWSABLE", "CHANGE_NOTIFY", "NON_BROWSABLE", "OPLOCKS", "SHOW_SNAPSHOT", "SHOW_PREVIOUS_VERSIONS", "ACCESS_BASED_ENUMERATION", "CONTINUOUSLY_AVAILABLE"] When `null`, the `smb_settings` field will be omitted from the resulting object.\n  - `snapshot_directory` (`bool`): If enabled, a NFS volume will contain a read-only .snapshot directory which provides access to each of the volume's snapshots. Will enable "Previous Versions" support for SMB. When `null`, the `snapshot_directory` field will be omitted from the resulting object.\n  - `storage_pool` (`string`): Name of the storage pool to create the volume in. Pool needs enough spare capacity to accomodate the volume.\n  - `unix_permissions` (`string`): Unix permission the mount point will be created with. Default is 0770. Applicable for UNIX security style volumes only. When `null`, the `unix_permissions` field will be omitted from the resulting object.\n  - `export_policy` (`list[obj]`): Export policy of the volume for NFSV3 and/or NFSV4.1 access. When `null`, the `export_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.export_policy.new](#fn-export_policynew) constructor.\n  - `snapshot_policy` (`list[obj]`): Snapshot policy defines the schedule for automatic snapshot creation.\nTo disable automatic snapshot creation you have to remove the whole snapshot_policy block. When `null`, the `snapshot_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.new](#fn-snapshot_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_volume` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    capacity_gib,
+    location,
+    name,
+    protocols,
+    share_name,
+    storage_pool,
+    deletion_policy=null,
+    description=null,
+    export_policy=null,
+    kerberos_enabled=null,
+    labels=null,
+    project=null,
+    restricted_actions=null,
+    security_style=null,
+    smb_settings=null,
+    snapshot_directory=null,
+    snapshot_policy=null,
+    timeouts=null,
+    unix_permissions=null
+  ):: std.prune(a={
+    capacity_gib: capacity_gib,
+    deletion_policy: deletion_policy,
+    description: description,
+    export_policy: export_policy,
+    kerberos_enabled: kerberos_enabled,
+    labels: labels,
+    location: location,
+    name: name,
+    project: project,
+    protocols: protocols,
+    restricted_actions: restricted_actions,
+    security_style: security_style,
+    share_name: share_name,
+    smb_settings: smb_settings,
+    snapshot_directory: snapshot_directory,
+    snapshot_policy: snapshot_policy,
+    storage_pool: storage_pool,
+    timeouts: timeouts,
+    unix_permissions: unix_permissions,
+  }),
+  snapshot_policy:: {
+    daily_schedule:: {
+      '#new':: d.fn(help='\n`google.netapp_volume.snapshot_policy.daily_schedule.new` constructs a new object with attributes and blocks configured for the `daily_schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hour` (`number`): Set the hour to create the snapshot (0-23), defaults to midnight (0). When `null`, the `hour` field will be omitted from the resulting object.\n  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.\n  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the daily schedule.\n\n**Returns**:\n  - An attribute object that represents the `daily_schedule` sub block.\n', args=[]),
+      new(
+        snapshots_to_keep,
+        hour=null,
+        minute=null
+      ):: std.prune(a={
+        hour: hour,
+        minute: minute,
+        snapshots_to_keep: snapshots_to_keep,
+      }),
+    },
+    hourly_schedule:: {
+      '#new':: d.fn(help='\n`google.netapp_volume.snapshot_policy.hourly_schedule.new` constructs a new object with attributes and blocks configured for the `hourly_schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.\n  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the hourly schedule.\n\n**Returns**:\n  - An attribute object that represents the `hourly_schedule` sub block.\n', args=[]),
+      new(
+        snapshots_to_keep,
+        minute=null
+      ):: std.prune(a={
+        minute: minute,
+        snapshots_to_keep: snapshots_to_keep,
+      }),
+    },
+    monthly_schedule:: {
+      '#new':: d.fn(help='\n`google.netapp_volume.snapshot_policy.monthly_schedule.new` constructs a new object with attributes and blocks configured for the `monthly_schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `days_of_month` (`string`): Set the day or days of the month to make a snapshot (1-31). Accepts a comma separated number of days. Defaults to '1'. When `null`, the `days_of_month` field will be omitted from the resulting object.\n  - `hour` (`number`): Set the hour to create the snapshot (0-23), defaults to midnight (0). When `null`, the `hour` field will be omitted from the resulting object.\n  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.\n  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the monthly schedule\n\n**Returns**:\n  - An attribute object that represents the `monthly_schedule` sub block.\n', args=[]),
+      new(
+        snapshots_to_keep,
+        days_of_month=null,
+        hour=null,
+        minute=null
+      ):: std.prune(a={
+        days_of_month: days_of_month,
+        hour: hour,
+        minute: minute,
+        snapshots_to_keep: snapshots_to_keep,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.netapp_volume.snapshot_policy.new` constructs a new object with attributes and blocks configured for the `snapshot_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Enables automated snapshot creation according to defined schedule. Default is false.\nTo disable automatic snapshot creation you have to remove the whole snapshot_policy block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `daily_schedule` (`list[obj]`): Daily schedule policy. When `null`, the `daily_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.daily_schedule.new](#fn-snapshot_policydaily_schedulenew) constructor.\n  - `hourly_schedule` (`list[obj]`): Hourly schedule policy. When `null`, the `hourly_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.hourly_schedule.new](#fn-snapshot_policyhourly_schedulenew) constructor.\n  - `monthly_schedule` (`list[obj]`): Monthly schedule policy. When `null`, the `monthly_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.monthly_schedule.new](#fn-snapshot_policymonthly_schedulenew) constructor.\n  - `weekly_schedule` (`list[obj]`): Weekly schedule policy. When `null`, the `weekly_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.weekly_schedule.new](#fn-snapshot_policyweekly_schedulenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `snapshot_policy` sub block.\n', args=[]),
+    new(
+      daily_schedule=null,
+      enabled=null,
+      hourly_schedule=null,
+      monthly_schedule=null,
+      weekly_schedule=null
+    ):: std.prune(a={
+      daily_schedule: daily_schedule,
+      enabled: enabled,
+      hourly_schedule: hourly_schedule,
+      monthly_schedule: monthly_schedule,
+      weekly_schedule: weekly_schedule,
+    }),
+    weekly_schedule:: {
+      '#new':: d.fn(help='\n`google.netapp_volume.snapshot_policy.weekly_schedule.new` constructs a new object with attributes and blocks configured for the `weekly_schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`string`): Set the day or days of the week to make a snapshot. Accepts a comma separated days of the week. Defaults to 'Sunday'. When `null`, the `day` field will be omitted from the resulting object.\n  - `hour` (`number`): Set the hour to create the snapshot (0-23), defaults to midnight (0). When `null`, the `hour` field will be omitted from the resulting object.\n  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.\n  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the weekly schedule.\n\n**Returns**:\n  - An attribute object that represents the `weekly_schedule` sub block.\n', args=[]),
+      new(
+        snapshots_to_keep,
+        day=null,
+        hour=null,
+        minute=null
+      ):: std.prune(a={
+        day: day,
+        hour: hour,
+        minute: minute,
+        snapshots_to_keep: snapshots_to_keep,
+      }),
+    },
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.netapp_volume.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCapacityGib':: d.fn(help='`google.string.withCapacityGib` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the capacity_gib field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `capacity_gib` field.\n', args=[]),
+  withCapacityGib(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          capacity_gib: value,
+        },
+      },
+    },
+  },
+  '#withDeletionPolicy':: d.fn(help='`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deletion_policy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deletion_policy` field.\n', args=[]),
+  withDeletionPolicy(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          deletion_policy: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withExportPolicy':: d.fn(help='`google.list[obj].withExportPolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the export_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withExportPolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `export_policy` field.\n', args=[]),
+  withExportPolicy(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          export_policy: value,
+        },
+      },
+    },
+  },
+  '#withExportPolicyMixin':: d.fn(help='`google.list[obj].withExportPolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the export_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withExportPolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `export_policy` field.\n', args=[]),
+  withExportPolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          export_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withKerberosEnabled':: d.fn(help='`google.bool.withKerberosEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the kerberos_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `kerberos_enabled` field.\n', args=[]),
+  withKerberosEnabled(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          kerberos_enabled: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withProtocols':: d.fn(help='`google.list.withProtocols` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the protocols field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `protocols` field.\n', args=[]),
+  withProtocols(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          protocols: value,
+        },
+      },
+    },
+  },
+  '#withRestrictedActions':: d.fn(help='`google.list.withRestrictedActions` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the restricted_actions field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `restricted_actions` field.\n', args=[]),
+  withRestrictedActions(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          restricted_actions: value,
+        },
+      },
+    },
+  },
+  '#withSecurityStyle':: d.fn(help='`google.string.withSecurityStyle` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the security_style field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `security_style` field.\n', args=[]),
+  withSecurityStyle(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          security_style: value,
+        },
+      },
+    },
+  },
+  '#withShareName':: d.fn(help='`google.string.withShareName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the share_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `share_name` field.\n', args=[]),
+  withShareName(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          share_name: value,
+        },
+      },
+    },
+  },
+  '#withSmbSettings':: d.fn(help='`google.list.withSmbSettings` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the smb_settings field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `smb_settings` field.\n', args=[]),
+  withSmbSettings(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          smb_settings: value,
+        },
+      },
+    },
+  },
+  '#withSnapshotDirectory':: d.fn(help='`google.bool.withSnapshotDirectory` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the snapshot_directory field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `snapshot_directory` field.\n', args=[]),
+  withSnapshotDirectory(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          snapshot_directory: value,
+        },
+      },
+    },
+  },
+  '#withSnapshotPolicy':: d.fn(help='`google.list[obj].withSnapshotPolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the snapshot_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSnapshotPolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `snapshot_policy` field.\n', args=[]),
+  withSnapshotPolicy(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          snapshot_policy: value,
+        },
+      },
+    },
+  },
+  '#withSnapshotPolicyMixin':: d.fn(help='`google.list[obj].withSnapshotPolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the snapshot_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSnapshotPolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `snapshot_policy` field.\n', args=[]),
+  withSnapshotPolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          snapshot_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStoragePool':: d.fn(help='`google.string.withStoragePool` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the storage_pool field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `storage_pool` field.\n', args=[]),
+  withStoragePool(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          storage_pool: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUnixPermissions':: d.fn(help='`google.string.withUnixPermissions` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the unix_permissions field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `unix_permissions` field.\n', args=[]),
+  withUnixPermissions(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume+: {
+        [resourceLabel]+: {
+          unix_permissions: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/netapp_volume_snapshot.libsonnet b/4.x/_gen/resources/netapp_volume_snapshot.libsonnet
new file mode 100644
index 00000000..a32ed0a8
--- /dev/null
+++ b/4.x/_gen/resources/netapp_volume_snapshot.libsonnet
@@ -0,0 +1,140 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='netapp_volume_snapshot', url='', help='`netapp_volume_snapshot` represents the `google_netapp_volume_snapshot` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.netapp_volume_snapshot.new` injects a new `google_netapp_volume_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.netapp_volume_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.netapp_volume_snapshot` using the reference:\n\n    $._ref.google_netapp_volume_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_netapp_volume_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description for the snapshot. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: \u0026#39;{ \u0026#34;owner\u0026#34;: \u0026#34;Bob\u0026#34;, \u0026#34;department\u0026#34;: \u0026#34;finance\u0026#34;, \u0026#34;purpose\u0026#34;: \u0026#34;testing\u0026#34; }\u0026#39;.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the snapshot location. Snapshots are child resources of volumes and live in the same location.\n  - `name` (`string`): The name of the snapshot.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `volume_name` (`string`): The name of the volume to create the snapshot in.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    volume_name,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_netapp_volume_snapshot',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      labels=labels,
+      location=location,
+      name=name,
+      project=project,
+      timeouts=timeouts,
+      volume_name=volume_name
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.netapp_volume_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_volume_snapshot`\nTerraform resource.\n\nUnlike [google.netapp_volume_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description for the snapshot. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Name of the snapshot location. Snapshots are child resources of volumes and live in the same location.\n  - `name` (`string`): The name of the snapshot.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `volume_name` (`string`): The name of the volume to create the snapshot in.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_volume_snapshot` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    volume_name,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    labels: labels,
+    location: location,
+    name: name,
+    project: project,
+    timeouts: timeouts,
+    volume_name: volume_name,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.netapp_volume_snapshot.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVolumeName':: d.fn(help='`google.string.withVolumeName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the volume_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `volume_name` field.\n', args=[]),
+  withVolumeName(resourceLabel, value): {
+    resource+: {
+      google_netapp_volume_snapshot+: {
+        [resourceLabel]+: {
+          volume_name: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/network_connectivity_hub.libsonnet b/4.x/_gen/resources/network_connectivity_hub.libsonnet
index 5ddd8bae..8dbef870 100644
--- a/4.x/_gen/resources/network_connectivity_hub.libsonnet
+++ b/4.x/_gen/resources/network_connectivity_hub.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_connectivity_hub', url='', help='`network_connectivity_hub` represents the `google_network_connectivity_hub` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_connectivity_hub.new` injects a new `google_network_connectivity_hub` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_hub.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_hub` using the reference:\n\n    $._ref.google_network_connectivity_hub.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_hub.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_connectivity_hub.new` injects a new `google_network_connectivity_hub` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_hub.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_hub` using the reference:\n\n    $._ref.google_network_connectivity_hub.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_hub.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_connectivity_hub.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_hub`\nTerraform resource.\n\nUnlike [google.network_connectivity_hub.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_hub` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_hub.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_hub`\nTerraform resource.\n\nUnlike [google.network_connectivity_hub.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_hub` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_connectivity_policy_based_route.libsonnet b/4.x/_gen/resources/network_connectivity_policy_based_route.libsonnet
new file mode 100644
index 00000000..f2d770b0
--- /dev/null
+++ b/4.x/_gen/resources/network_connectivity_policy_based_route.libsonnet
@@ -0,0 +1,270 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='network_connectivity_policy_based_route', url='', help='`network_connectivity_policy_based_route` represents the `google_network_connectivity_policy_based_route` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  filter:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.filter.new` constructs a new object with attributes and blocks configured for the `filter`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dest_range` (`string`): The destination IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `dest_range` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol that this policy-based route applies to. Valid values are 'TCP', 'UDP', and 'ALL'. Default is 'ALL'. When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `protocol_version` (`string`): Internet protocol versions this policy-based route applies to. Possible values: ["IPV4"]\n  - `src_range` (`string`): The source IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `src_range` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `filter` sub block.\n', args=[]),
+    new(
+      protocol_version,
+      dest_range=null,
+      ip_protocol=null,
+      src_range=null
+    ):: std.prune(a={
+      dest_range: dest_range,
+      ip_protocol: ip_protocol,
+      protocol_version: protocol_version,
+      src_range: src_range,
+    }),
+  },
+  interconnect_attachment:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.interconnect_attachment.new` constructs a new object with attributes and blocks configured for the `interconnect_attachment`\nTerraform sub block.\n\n\n\n**Args**:\n  - `region` (`string`): Cloud region to install this policy-based route on for Interconnect attachments. Use 'all' to install it on all Interconnect attachments.\n\n**Returns**:\n  - An attribute object that represents the `interconnect_attachment` sub block.\n', args=[]),
+    new(
+      region
+    ):: std.prune(a={
+      region: region,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.network_connectivity_policy_based_route.new` injects a new `google_network_connectivity_policy_based_route` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_policy_based_route.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_policy_based_route` using the reference:\n\n    $._ref.google_network_connectivity_policy_based_route.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_policy_based_route.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the policy based route.\n  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.\n  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.\n  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: [\u0026#34;DEFAULT_ROUTING\u0026#34;] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.\n  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    network,
+    description=null,
+    filter=null,
+    interconnect_attachment=null,
+    labels=null,
+    next_hop_ilb_ip=null,
+    next_hop_other_routes=null,
+    priority=null,
+    project=null,
+    timeouts=null,
+    virtual_machine=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_network_connectivity_policy_based_route',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      filter=filter,
+      interconnect_attachment=interconnect_attachment,
+      labels=labels,
+      name=name,
+      network=network,
+      next_hop_ilb_ip=next_hop_ilb_ip,
+      next_hop_other_routes=next_hop_other_routes,
+      priority=priority,
+      project=project,
+      timeouts=timeouts,
+      virtual_machine=virtual_machine
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_policy_based_route.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_policy_based_route`\nTerraform resource.\n\nUnlike [google.network_connectivity_policy_based_route.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the policy based route.\n  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.\n  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.\n  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: ["DEFAULT_ROUTING"] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.\n  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_policy_based_route` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    network,
+    description=null,
+    filter=null,
+    interconnect_attachment=null,
+    labels=null,
+    next_hop_ilb_ip=null,
+    next_hop_other_routes=null,
+    priority=null,
+    project=null,
+    timeouts=null,
+    virtual_machine=null
+  ):: std.prune(a={
+    description: description,
+    filter: filter,
+    interconnect_attachment: interconnect_attachment,
+    labels: labels,
+    name: name,
+    network: network,
+    next_hop_ilb_ip: next_hop_ilb_ip,
+    next_hop_other_routes: next_hop_other_routes,
+    priority: priority,
+    project: project,
+    timeouts: timeouts,
+    virtual_machine: virtual_machine,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  virtual_machine:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.virtual_machine.new` constructs a new object with attributes and blocks configured for the `virtual_machine`\nTerraform sub block.\n\n\n\n**Args**:\n  - `tags` (`list`): A list of VM instance tags that this policy-based route applies to. VM instances that have ANY of tags specified here will install this PBR.\n\n**Returns**:\n  - An attribute object that represents the `virtual_machine` sub block.\n', args=[]),
+    new(
+      tags
+    ):: std.prune(a={
+      tags: tags,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withFilter':: d.fn(help='`google.list[obj].withFilter` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the filter field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFilterMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `filter` field.\n', args=[]),
+  withFilter(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          filter: value,
+        },
+      },
+    },
+  },
+  '#withFilterMixin':: d.fn(help='`google.list[obj].withFilterMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the filter field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFilter](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `filter` field.\n', args=[]),
+  withFilterMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          filter+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withInterconnectAttachment':: d.fn(help='`google.list[obj].withInterconnectAttachment` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the interconnect_attachment field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withInterconnectAttachmentMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.\n', args=[]),
+  withInterconnectAttachment(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          interconnect_attachment: value,
+        },
+      },
+    },
+  },
+  '#withInterconnectAttachmentMixin':: d.fn(help='`google.list[obj].withInterconnectAttachmentMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the interconnect_attachment field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withInterconnectAttachment](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.\n', args=[]),
+  withInterconnectAttachmentMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          interconnect_attachment+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetwork':: d.fn(help='`google.string.withNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `network` field.\n', args=[]),
+  withNetwork(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          network: value,
+        },
+      },
+    },
+  },
+  '#withNextHopIlbIp':: d.fn(help='`google.string.withNextHopIlbIp` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the next_hop_ilb_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `next_hop_ilb_ip` field.\n', args=[]),
+  withNextHopIlbIp(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          next_hop_ilb_ip: value,
+        },
+      },
+    },
+  },
+  '#withNextHopOtherRoutes':: d.fn(help='`google.string.withNextHopOtherRoutes` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the next_hop_other_routes field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `next_hop_other_routes` field.\n', args=[]),
+  withNextHopOtherRoutes(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          next_hop_other_routes: value,
+        },
+      },
+    },
+  },
+  '#withPriority':: d.fn(help='`google.number.withPriority` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the priority field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `priority` field.\n', args=[]),
+  withPriority(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          priority: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVirtualMachine':: d.fn(help='`google.list[obj].withVirtualMachine` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the virtual_machine field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVirtualMachineMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.\n', args=[]),
+  withVirtualMachine(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          virtual_machine: value,
+        },
+      },
+    },
+  },
+  '#withVirtualMachineMixin':: d.fn(help='`google.list[obj].withVirtualMachineMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the virtual_machine field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVirtualMachine](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.\n', args=[]),
+  withVirtualMachineMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          virtual_machine+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet b/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet
index fb081074..97963a14 100644
--- a/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet
+++ b/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_connectivity_service_connection_policy', url='', help='`network_connectivity_service_connection_policy` represents the `google_network_connectivity_service_connection_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_connectivity_service_connection_policy.new` injects a new `google_network_connectivity_service_connection_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_service_connection_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_service_connection_policy` using the reference:\n\n    $._ref.google_network_connectivity_service_connection_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_service_connection_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_connectivity_service_connection_policy.new` injects a new `google_network_connectivity_service_connection_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_service_connection_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_service_connection_policy` using the reference:\n\n    $._ref.google_network_connectivity_service_connection_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_service_connection_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_connectivity_service_connection_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_service_connection_policy`\nTerraform resource.\n\nUnlike [google.network_connectivity_service_connection_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_service_connection_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_service_connection_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_service_connection_policy`\nTerraform resource.\n\nUnlike [google.network_connectivity_service_connection_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_service_connection_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/network_connectivity_spoke.libsonnet b/4.x/_gen/resources/network_connectivity_spoke.libsonnet
index 24110b39..118c2ccd 100644
--- a/4.x/_gen/resources/network_connectivity_spoke.libsonnet
+++ b/4.x/_gen/resources/network_connectivity_spoke.libsonnet
@@ -52,7 +52,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       uris: uris,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_connectivity_spoke.new` injects a new `google_network_connectivity_spoke` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_spoke.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_spoke` using the reference:\n\n    $._ref.google_network_connectivity_spoke.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_spoke.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_connectivity_spoke.new` injects a new `google_network_connectivity_spoke` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_spoke.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_spoke` using the reference:\n\n    $._ref.google_network_connectivity_spoke.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_spoke.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     hub,
@@ -85,7 +85,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_connectivity_spoke.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_spoke`\nTerraform resource.\n\nUnlike [google.network_connectivity_spoke.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_spoke` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_spoke.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_spoke`\nTerraform resource.\n\nUnlike [google.network_connectivity_spoke.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_spoke` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     hub,
     location,
diff --git a/4.x/_gen/resources/network_management_connectivity_test.libsonnet b/4.x/_gen/resources/network_management_connectivity_test.libsonnet
index edcef286..2e777f26 100644
--- a/4.x/_gen/resources/network_management_connectivity_test.libsonnet
+++ b/4.x/_gen/resources/network_management_connectivity_test.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project_id: project_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_management_connectivity_test.new` injects a new `google_network_management_connectivity_test` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_management_connectivity_test.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_management_connectivity_test` using the reference:\n\n    $._ref.google_network_management_connectivity_test.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_management_connectivity_test.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, \u0026#34;TCP\u0026#34; is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon\u0026#39;t intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don\u0026#39;t intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_management_connectivity_test.new` injects a new `google_network_management_connectivity_test` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_management_connectivity_test.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_management_connectivity_test` using the reference:\n\n    $._ref.google_network_management_connectivity_test.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_management_connectivity_test.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, \u0026#34;TCP\u0026#34; is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon\u0026#39;t intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don\u0026#39;t intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -47,7 +47,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_management_connectivity_test.newAttrs` constructs a new object with attributes and blocks configured for the `network_management_connectivity_test`\nTerraform resource.\n\nUnlike [google.network_management_connectivity_test.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon't intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don't intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_management_connectivity_test` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_management_connectivity_test.newAttrs` constructs a new object with attributes and blocks configured for the `network_management_connectivity_test`\nTerraform resource.\n\nUnlike [google.network_management_connectivity_test.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon't intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don't intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_management_connectivity_test` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_security_address_group.libsonnet b/4.x/_gen/resources/network_security_address_group.libsonnet
index 070a1cd3..576fa8e8 100644
--- a/4.x/_gen/resources/network_security_address_group.libsonnet
+++ b/4.x/_gen/resources/network_security_address_group.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_security_address_group', url='', help='`network_security_address_group` represents the `google_network_security_address_group` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_security_address_group.new` injects a new `google_network_security_address_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group` using the reference:\n\n    $._ref.google_network_security_address_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is \u0026#39;global\u0026#39;.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are \u0026#34;IPV4\u0026#34; or \u0026#34;IPV6\u0026#34;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_security_address_group.new` injects a new `google_network_security_address_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group` using the reference:\n\n    $._ref.google_network_security_address_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is \u0026#39;global\u0026#39;.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are \u0026#34;IPV4\u0026#34; or \u0026#34;IPV6\u0026#34;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     capacity,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_security_address_group.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group`\nTerraform resource.\n\nUnlike [google.network_security_address_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is 'global'.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are "IPV4" or "IPV6". Possible values: ["IPV4", "IPV6"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_security_address_group.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group`\nTerraform resource.\n\nUnlike [google.network_security_address_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is 'global'.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are "IPV4" or "IPV6". Possible values: ["IPV4", "IPV6"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     capacity,
     location,
diff --git a/4.x/_gen/resources/network_security_address_group_iam_binding.libsonnet b/4.x/_gen/resources/network_security_address_group_iam_binding.libsonnet
new file mode 100644
index 00000000..61c1d541
--- /dev/null
+++ b/4.x/_gen/resources/network_security_address_group_iam_binding.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='network_security_address_group_iam_binding', url='', help='`network_security_address_group_iam_binding` represents the `google_network_security_address_group_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.network_security_address_group_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.network_security_address_group_iam_binding.new` injects a new `google_network_security_address_group_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group_iam_binding` using the reference:\n\n    $._ref.google_network_security_address_group_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    members,
+    name,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_network_security_address_group_iam_binding',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      location=location,
+      members=members,
+      name=name,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.network_security_address_group_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_binding`\nTerraform resource.\n\nUnlike [google.network_security_address_group_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    members,
+    name,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    location: location,
+    members: members,
+    name: name,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
+  withMembers(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          members: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_binding+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/network_security_address_group_iam_member.libsonnet b/4.x/_gen/resources/network_security_address_group_iam_member.libsonnet
new file mode 100644
index 00000000..bf857778
--- /dev/null
+++ b/4.x/_gen/resources/network_security_address_group_iam_member.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='network_security_address_group_iam_member', url='', help='`network_security_address_group_iam_member` represents the `google_network_security_address_group_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.network_security_address_group_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.network_security_address_group_iam_member.new` injects a new `google_network_security_address_group_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group_iam_member` using the reference:\n\n    $._ref.google_network_security_address_group_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    member,
+    name,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_network_security_address_group_iam_member',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      location=location,
+      member=member,
+      name=name,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.network_security_address_group_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_member`\nTerraform resource.\n\nUnlike [google.network_security_address_group_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    member,
+    name,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    location: location,
+    member: member,
+    name: name,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
+  withMember(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          member: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_member+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/network_security_address_group_iam_policy.libsonnet b/4.x/_gen/resources/network_security_address_group_iam_policy.libsonnet
new file mode 100644
index 00000000..54f9dd29
--- /dev/null
+++ b/4.x/_gen/resources/network_security_address_group_iam_policy.libsonnet
@@ -0,0 +1,76 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='network_security_address_group_iam_policy', url='', help='`network_security_address_group_iam_policy` represents the `google_network_security_address_group_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.network_security_address_group_iam_policy.new` injects a new `google_network_security_address_group_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group_iam_policy` using the reference:\n\n    $._ref.google_network_security_address_group_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    policy_data,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_network_security_address_group_iam_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      location=location,
+      name=name,
+      policy_data=policy_data,
+      project=project
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.network_security_address_group_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_policy`\nTerraform resource.\n\nUnlike [google.network_security_address_group_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    policy_data,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    policy_data: policy_data,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_policy+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
+  withPolicyData(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_policy+: {
+        [resourceLabel]+: {
+          policy_data: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_network_security_address_group_iam_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet b/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet
index c9d99966..56e4fce7 100644
--- a/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet
+++ b/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_services_edge_cache_keyset', url='', help='`network_services_edge_cache_keyset` represents the `google_network_services_edge_cache_keyset` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_services_edge_cache_keyset.new` injects a new `google_network_services_edge_cache_keyset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_keyset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_keyset` using the reference:\n\n    $._ref.google_network_services_edge_cache_keyset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_keyset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify \u0026#39;public_keys\u0026#39;, you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add \u0026#39;validation_shared_keys\u0026#39; to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of \u0026#39;validation_shared_keys\u0026#39; and removing any superseded keys.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_edge_cache_keyset.new` injects a new `google_network_services_edge_cache_keyset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_keyset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_keyset` using the reference:\n\n    $._ref.google_network_services_edge_cache_keyset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_keyset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify \u0026#39;public_keys\u0026#39;, you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add \u0026#39;validation_shared_keys\u0026#39; to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of \u0026#39;validation_shared_keys\u0026#39; and removing any superseded keys.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_keyset.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_keyset`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_keyset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify 'public_keys', you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add 'validation_shared_keys' to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of 'validation_shared_keys' and removing any superseded keys.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_keyset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_keyset.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_keyset`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_keyset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify 'public_keys', you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add 'validation_shared_keys' to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of 'validation_shared_keys' and removing any superseded keys.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_keyset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet b/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet
index 654060f3..187f10c2 100644
--- a/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet
+++ b/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet
@@ -14,7 +14,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       secret_access_key_version: secret_access_key_version,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_services_edge_cache_origin.new` injects a new `google_network_services_edge_cache_origin` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_origin.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_origin` using the reference:\n\n    $._ref.google_network_services_edge_cache_origin.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_origin.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical \u0026#34;gs://bucketname\u0026#34; format. Other forms, such as \u0026#34;storage.googleapis.com\u0026#34;, will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security \u0026amp; performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: [\u0026#34;HTTP2\u0026#34;, \u0026#34;HTTPS\u0026#34;, \u0026#34;HTTP\u0026#34;] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is \u0026#34;CONNECT_FAILURE\u0026#34;.\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: [\u0026#34;CONNECT_FAILURE\u0026#34;, \u0026#34;HTTP_5XX\u0026#34;, \u0026#34;GATEWAY_ERROR\u0026#34;, \u0026#34;RETRIABLE_4XX\u0026#34;, \u0026#34;NOT_FOUND\u0026#34;, \u0026#34;FORBIDDEN\u0026#34;] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_edge_cache_origin.new` injects a new `google_network_services_edge_cache_origin` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_origin.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_origin` using the reference:\n\n    $._ref.google_network_services_edge_cache_origin.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_origin.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical \u0026#34;gs://bucketname\u0026#34; format. Other forms, such as \u0026#34;storage.googleapis.com\u0026#34;, will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security \u0026amp; performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: [\u0026#34;HTTP2\u0026#34;, \u0026#34;HTTPS\u0026#34;, \u0026#34;HTTP\u0026#34;] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is \u0026#34;CONNECT_FAILURE\u0026#34;.\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: [\u0026#34;CONNECT_FAILURE\u0026#34;, \u0026#34;HTTP_5XX\u0026#34;, \u0026#34;GATEWAY_ERROR\u0026#34;, \u0026#34;RETRIABLE_4XX\u0026#34;, \u0026#34;NOT_FOUND\u0026#34;, \u0026#34;FORBIDDEN\u0026#34;] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -55,7 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_origin.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_origin`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_origin.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical "gs://bucketname" format. Other forms, such as "storage.googleapis.com", will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security & performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: ["HTTP2", "HTTPS", "HTTP"] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is "CONNECT_FAILURE".\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: ["CONNECT_FAILURE", "HTTP_5XX", "GATEWAY_ERROR", "RETRIABLE_4XX", "NOT_FOUND", "FORBIDDEN"] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_origin` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_origin.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_origin`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_origin.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical "gs://bucketname" format. Other forms, such as "storage.googleapis.com", will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security & performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: ["HTTP2", "HTTPS", "HTTP"] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is "CONNECT_FAILURE".\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: ["CONNECT_FAILURE", "HTTP_5XX", "GATEWAY_ERROR", "RETRIABLE_4XX", "NOT_FOUND", "FORBIDDEN"] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_origin` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     origin_address,
diff --git a/4.x/_gen/resources/network_services_edge_cache_service.libsonnet b/4.x/_gen/resources/network_services_edge_cache_service.libsonnet
index 41ae49bc..7f187a5f 100644
--- a/4.x/_gen/resources/network_services_edge_cache_service.libsonnet
+++ b/4.x/_gen/resources/network_services_edge_cache_service.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       sample_rate: sample_rate,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_services_edge_cache_service.new` injects a new `google_network_services_edge_cache_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_service` using the reference:\n\n    $._ref.google_network_services_edge_cache_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only \u0026#34;global\u0026#34; certificates with a \u0026#34;scope\u0026#34; of \u0026#34;EDGE_CACHE\u0026#34; can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the \u0026#34;COMPATIBLE\u0026#34; policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_edge_cache_service.new` injects a new `google_network_services_edge_cache_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_service` using the reference:\n\n    $._ref.google_network_services_edge_cache_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only \u0026#34;global\u0026#34; certificates with a \u0026#34;scope\u0026#34; of \u0026#34;EDGE_CACHE\u0026#34; can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the \u0026#34;COMPATIBLE\u0026#34; policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_service.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_service`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the "COMPATIBLE" policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_service.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_service`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the "COMPATIBLE" policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_services_gateway.libsonnet b/4.x/_gen/resources/network_services_gateway.libsonnet
index ea902964..3d0d5d15 100644
--- a/4.x/_gen/resources/network_services_gateway.libsonnet
+++ b/4.x/_gen/resources/network_services_gateway.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_services_gateway', url='', help='`network_services_gateway` represents the `google_network_services_gateway` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_services_gateway.new` injects a new `google_network_services_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_gateway` using the reference:\n\n    $._ref.google_network_services_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;.\nGateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;, this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: \u0026#39;projects/*/locations/*/gatewaySecurityPolicies/swg-policy\u0026#39;.\nThis policy is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: \u0026#39;projects/*/global/networks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; are\nlimited to 1 port. Gateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: \u0026#39;projects/*/regions/us-central1/subnetworks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;OPEN_MESH\u0026#34;, \u0026#34;SECURE_WEB_GATEWAY\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_gateway.new` injects a new `google_network_services_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_gateway` using the reference:\n\n    $._ref.google_network_services_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;.\nGateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;, this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: \u0026#39;projects/*/locations/*/gatewaySecurityPolicies/swg-policy\u0026#39;.\nThis policy is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: \u0026#39;projects/*/global/networks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; are\nlimited to 1 port. Gateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: \u0026#39;projects/*/regions/us-central1/subnetworks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;OPEN_MESH\u0026#34;, \u0026#34;SECURE_WEB_GATEWAY\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -45,7 +45,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_gateway`\nTerraform resource.\n\nUnlike [google.network_services_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type 'SECURE_WEB_GATEWAY'.\nGateways of type 'OPEN_MESH' listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type 'SECURE_WEB_GATEWAY', this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.\nThis policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: 'projects/*/global/networks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type 'SECURE_WEB_GATEWAY' are\nlimited to 1 port. Gateways of type 'OPEN_MESH' listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: 'projects/*/regions/us-central1/subnetworks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: ["TYPE_UNSPECIFIED", "OPEN_MESH", "SECURE_WEB_GATEWAY"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_gateway` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_gateway`\nTerraform resource.\n\nUnlike [google.network_services_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type 'SECURE_WEB_GATEWAY'.\nGateways of type 'OPEN_MESH' listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type 'SECURE_WEB_GATEWAY', this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.\nThis policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: 'projects/*/global/networks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type 'SECURE_WEB_GATEWAY' are\nlimited to 1 port. Gateways of type 'OPEN_MESH' listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: 'projects/*/regions/us-central1/subnetworks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: ["TYPE_UNSPECIFIED", "OPEN_MESH", "SECURE_WEB_GATEWAY"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_gateway` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     ports,
diff --git a/4.x/_gen/resources/notebooks_instance.libsonnet b/4.x/_gen/resources/notebooks_instance.libsonnet
index 2bbe914b..a0150e6f 100644
--- a/4.x/_gen/resources/notebooks_instance.libsonnet
+++ b/4.x/_gen/resources/notebooks_instance.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       tag: tag,
     }),
   },
-  '#new':: d.fn(help="\n`google.notebooks_instance.new` injects a new `google_notebooks_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.notebooks_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.notebooks_instance` using the reference:\n\n    $._ref.google_notebooks_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_notebooks_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we\u0026#39;ll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: [\u0026#34;DISK_ENCRYPTION_UNSPECIFIED\u0026#34;, \u0026#34;GMEK\u0026#34;, \u0026#34;CMEK\u0026#34;] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon\u0026#39;t be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance\u0026#39;s service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: [\u0026#34;UNSPECIFIED_NIC_TYPE\u0026#34;, \u0026#34;VIRTIO_NET\u0026#34;, \u0026#34;GVNIC\u0026#34;] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.notebooks_instance.new` injects a new `google_notebooks_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.notebooks_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.notebooks_instance` using the reference:\n\n    $._ref.google_notebooks_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_notebooks_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we\u0026#39;ll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: [\u0026#34;DISK_ENCRYPTION_UNSPECIFIED\u0026#34;, \u0026#34;GMEK\u0026#34;, \u0026#34;CMEK\u0026#34;] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon\u0026#39;t be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance\u0026#39;s service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: [\u0026#34;UNSPECIFIED_NIC_TYPE\u0026#34;, \u0026#34;VIRTIO_NET\u0026#34;, \u0026#34;GVNIC\u0026#34;] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -99,7 +99,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.notebooks_instance.newAttrs` constructs a new object with attributes and blocks configured for the `notebooks_instance`\nTerraform resource.\n\nUnlike [google.notebooks_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we'll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: ["DISK_ENCRYPTION_UNSPECIFIED", "GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon't be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance's service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: ["UNSPECIFIED_NIC_TYPE", "VIRTIO_NET", "GVNIC"] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `notebooks_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.notebooks_instance.newAttrs` constructs a new object with attributes and blocks configured for the `notebooks_instance`\nTerraform resource.\n\nUnlike [google.notebooks_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we'll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: ["DISK_ENCRYPTION_UNSPECIFIED", "GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon't be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance's service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: ["UNSPECIFIED_NIC_TYPE", "VIRTIO_NET", "GVNIC"] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `notebooks_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     machine_type,
diff --git a/4.x/_gen/resources/notebooks_runtime.libsonnet b/4.x/_gen/resources/notebooks_runtime.libsonnet
index 6c9c3c93..335840c7 100644
--- a/4.x/_gen/resources/notebooks_runtime.libsonnet
+++ b/4.x/_gen/resources/notebooks_runtime.libsonnet
@@ -12,12 +12,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       runtime_owner: runtime_owner,
     }),
   },
-  '#new':: d.fn(help="\n`google.notebooks_runtime.new` injects a new `google_notebooks_runtime` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.notebooks_runtime.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.notebooks_runtime` using the reference:\n\n    $._ref.google_notebooks_runtime.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_notebooks_runtime.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `name` (`string`): The name specified for the Notebook runtime.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `access_config` (`list[obj]`): The config settings for accessing runtime. When `null`, the `access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.access_config.new](#fn-access_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the runtime. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.software_config.new](#fn-software_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): Use a Compute Engine VM image to start the managed notebook instance. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.notebooks_runtime.new` injects a new `google_notebooks_runtime` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.notebooks_runtime.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.notebooks_runtime` using the reference:\n\n    $._ref.google_notebooks_runtime.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_notebooks_runtime.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): The labels to associate with this runtime. Label **keys** must\ncontain 1 to 63 characters, and must conform to [RFC 1035]\n(https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be\nempty, but, if present, must contain 1 to 63 characters, and must\nconform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No\nmore than 32 labels can be associated with a cluster.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `name` (`string`): The name specified for the Notebook runtime.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `access_config` (`list[obj]`): The config settings for accessing runtime. When `null`, the `access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.access_config.new](#fn-access_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the runtime. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.software_config.new](#fn-software_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): Use a Compute Engine VM image to start the managed notebook instance. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
     name,
     access_config=null,
+    labels=null,
     project=null,
     software_config=null,
     timeouts=null,
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       access_config=access_config,
+      labels=labels,
       location=location,
       name=name,
       project=project,
@@ -37,17 +39,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.notebooks_runtime.newAttrs` constructs a new object with attributes and blocks configured for the `notebooks_runtime`\nTerraform resource.\n\nUnlike [google.notebooks_runtime.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `name` (`string`): The name specified for the Notebook runtime.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `access_config` (`list[obj]`): The config settings for accessing runtime. When `null`, the `access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.access_config.new](#fn-access_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the runtime. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.software_config.new](#fn-software_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): Use a Compute Engine VM image to start the managed notebook instance. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `notebooks_runtime` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.notebooks_runtime.newAttrs` constructs a new object with attributes and blocks configured for the `notebooks_runtime`\nTerraform resource.\n\nUnlike [google.notebooks_runtime.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): The labels to associate with this runtime. Label **keys** must\ncontain 1 to 63 characters, and must conform to [RFC 1035]\n(https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be\nempty, but, if present, must contain 1 to 63 characters, and must\nconform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No\nmore than 32 labels can be associated with a cluster.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `name` (`string`): The name specified for the Notebook runtime.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `access_config` (`list[obj]`): The config settings for accessing runtime. When `null`, the `access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.access_config.new](#fn-access_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the runtime. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.software_config.new](#fn-software_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): Use a Compute Engine VM image to start the managed notebook instance. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_runtime.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `notebooks_runtime` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
     access_config=null,
+    labels=null,
     project=null,
     software_config=null,
     timeouts=null,
     virtual_machine=null
   ):: std.prune(a={
     access_config: access_config,
+    labels: labels,
     location: location,
     name: name,
     project: project,
@@ -235,6 +239,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_notebooks_runtime+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/org_policy_custom_constraint.libsonnet b/4.x/_gen/resources/org_policy_custom_constraint.libsonnet
new file mode 100644
index 00000000..a0c76dc9
--- /dev/null
+++ b/4.x/_gen/resources/org_policy_custom_constraint.libsonnet
@@ -0,0 +1,168 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='org_policy_custom_constraint', url='', help='`org_policy_custom_constraint` represents the `google_org_policy_custom_constraint` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.org_policy_custom_constraint.new` injects a new `google_org_policy_custom_constraint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.org_policy_custom_constraint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.org_policy_custom_constraint` using the reference:\n\n    $._ref.google_org_policy_custom_constraint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_org_policy_custom_constraint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `action_type` (`string`): The action to take if the condition is met. Possible values: [\u0026#34;ALLOW\u0026#34;, \u0026#34;DENY\u0026#34;]\n  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example \u0026#39;resource.management.autoUpgrade == false\u0026#39;. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).\n  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be \u0026#39;CREATE\u0026#39;, \u0026#39;UPDATE\u0026#39;, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).\n  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be \u0026#39;organizations/{organization_id}\u0026#39;.\n  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, \u0026#39;container.googleapis.com/NodePool\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    action_type,
+    condition,
+    method_types,
+    name,
+    parent,
+    resource_types,
+    description=null,
+    display_name=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_org_policy_custom_constraint',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      action_type=action_type,
+      condition=condition,
+      description=description,
+      display_name=display_name,
+      method_types=method_types,
+      name=name,
+      parent=parent,
+      resource_types=resource_types,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.org_policy_custom_constraint.newAttrs` constructs a new object with attributes and blocks configured for the `org_policy_custom_constraint`\nTerraform resource.\n\nUnlike [google.org_policy_custom_constraint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]\n  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).\n  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).\n  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.\n  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_custom_constraint` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    action_type,
+    condition,
+    method_types,
+    name,
+    parent,
+    resource_types,
+    description=null,
+    display_name=null,
+    timeouts=null
+  ):: std.prune(a={
+    action_type: action_type,
+    condition: condition,
+    description: description,
+    display_name: display_name,
+    method_types: method_types,
+    name: name,
+    parent: parent,
+    resource_types: resource_types,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.org_policy_custom_constraint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withActionType':: d.fn(help='`google.string.withActionType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the action_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `action_type` field.\n', args=[]),
+  withActionType(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          action_type: value,
+        },
+      },
+    },
+  },
+  '#withCondition':: d.fn(help='`google.string.withCondition` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the condition field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withMethodTypes':: d.fn(help='`google.list.withMethodTypes` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the method_types field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `method_types` field.\n', args=[]),
+  withMethodTypes(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          method_types: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withResourceTypes':: d.fn(help='`google.list.withResourceTypes` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the resource_types field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `resource_types` field.\n', args=[]),
+  withResourceTypes(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          resource_types: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/org_policy_policy.libsonnet b/4.x/_gen/resources/org_policy_policy.libsonnet
index cda8fbe3..66b2150c 100644
--- a/4.x/_gen/resources/org_policy_policy.libsonnet
+++ b/4.x/_gen/resources/org_policy_policy.libsonnet
@@ -2,11 +2,64 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='org_policy_policy', url='', help='`org_policy_policy` represents the `google_org_policy_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.org_policy_policy.new` injects a new `google_org_policy_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.org_policy_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.org_policy_policy` using the reference:\n\n    $._ref.google_org_policy_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_org_policy_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `name` (`string`): Immutable. The resource name of the Policy. Must be one of the following forms, where constraint_name is the name of the constraint which this Policy configures: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}` For example, \u0026#34;projects/123/policies/compute.disableSerialPortAccess\u0026#34;. Note: `projects/{project_id}/policies/{constraint_name}` is also an acceptable name for API requests, but responses will return the name using the equivalent project number.\n  - `parent` (`string`): The parent of the resource.\n  - `spec` (`list[obj]`): Basic information about the Organization Policy. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  dry_run_spec:: {
+    '#new':: d.fn(help='\n`google.org_policy_policy.dry_run_spec.new` constructs a new object with attributes and blocks configured for the `dry_run_spec`\nTerraform sub block.\n\n\n\n**Args**:\n  - `inherit_from_parent` (`bool`): Determines the inheritance behavior for this policy. If `inherit_from_parent` is true, policy rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the new root for evaluation. This field can be set only for policies which configure list constraints. When `null`, the `inherit_from_parent` field will be omitted from the resulting object.\n  - `reset` (`bool`): Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false. When `null`, the `reset` field will be omitted from the resulting object.\n  - `rules` (`list[obj]`): In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.rules.new](#fn-dry_run_specrulesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `dry_run_spec` sub block.\n', args=[]),
+    new(
+      inherit_from_parent=null,
+      reset=null,
+      rules=null
+    ):: std.prune(a={
+      inherit_from_parent: inherit_from_parent,
+      reset: reset,
+      rules: rules,
+    }),
+    rules:: {
+      condition:: {
+        '#new':: d.fn(help='\n`google.org_policy_policy.dry_run_spec.rules.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax. When `null`, the `expression` field will be omitted from the resulting object.\n  - `location` (`string`): Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+        new(
+          description=null,
+          expression=null,
+          location=null,
+          title=null
+        ):: std.prune(a={
+          description: description,
+          expression: expression,
+          location: location,
+          title: title,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.org_policy_policy.dry_run_spec.rules.new` constructs a new object with attributes and blocks configured for the `rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_all` (`string`): Setting this to `"TRUE"` means that all values are allowed. This field can be set only in policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.\n  - `deny_all` (`string`): Setting this to `"TRUE"` means that all values are denied. This field can be set only in policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.\n  - `enforce` (`string`): If `"TRUE"`, then the policy is enforced. If `"FALSE"`, then any configuration is acceptable. This field can be set only in policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.\n  - `condition` (`list[obj]`): A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')". When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.rules.condition.new](#fn-dry_run_specdry_run_specconditionnew) constructor.\n  - `values` (`list[obj]`): List of values to be used for this policy rule. This field can be set only in policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.rules.values.new](#fn-dry_run_specdry_run_specvaluesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `rules` sub block.\n', args=[]),
+      new(
+        allow_all=null,
+        condition=null,
+        deny_all=null,
+        enforce=null,
+        values=null
+      ):: std.prune(a={
+        allow_all: allow_all,
+        condition: condition,
+        deny_all: deny_all,
+        enforce: enforce,
+        values: values,
+      }),
+      values:: {
+        '#new':: d.fn(help='\n`google.org_policy_policy.dry_run_spec.rules.values.new` constructs a new object with attributes and blocks configured for the `values`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_values` (`list`): List of values allowed at this resource. When `null`, the `allowed_values` field will be omitted from the resulting object.\n  - `denied_values` (`list`): List of values denied at this resource. When `null`, the `denied_values` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `values` sub block.\n', args=[]),
+        new(
+          allowed_values=null,
+          denied_values=null
+        ):: std.prune(a={
+          allowed_values: allowed_values,
+          denied_values: denied_values,
+        }),
+      },
+    },
+  },
+  '#new':: d.fn(help="\n`google.org_policy_policy.new` injects a new `google_org_policy_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.org_policy_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.org_policy_policy` using the reference:\n\n    $._ref.google_org_policy_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_org_policy_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `name` (`string`): Immutable. The resource name of the Policy. Must be one of the following forms, where constraint_name is the name of the constraint which this Policy configures: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}` For example, \u0026#34;projects/123/policies/compute.disableSerialPortAccess\u0026#34;. Note: `projects/{project_id}/policies/{constraint_name}` is also an acceptable name for API requests, but responses will return the name using the equivalent project number.\n  - `parent` (`string`): The parent of the resource.\n  - `dry_run_spec` (`list[obj]`): Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it\u0026#39;s enforced. When `null`, the `dry_run_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.new](#fn-dry_run_specnew) constructor.\n  - `spec` (`list[obj]`): Basic information about the Organization Policy. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
     parent,
+    dry_run_spec=null,
     spec=null,
     timeouts=null,
     _meta={}
@@ -14,6 +67,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_org_policy_policy',
     label=resourceLabel,
     attrs=self.newAttrs(
+      dry_run_spec=dry_run_spec,
       name=name,
       parent=parent,
       spec=spec,
@@ -21,13 +75,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.org_policy_policy.newAttrs` constructs a new object with attributes and blocks configured for the `org_policy_policy`\nTerraform resource.\n\nUnlike [google.org_policy_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Immutable. The resource name of the Policy. Must be one of the following forms, where constraint_name is the name of the constraint which this Policy configures: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}` For example, "projects/123/policies/compute.disableSerialPortAccess". Note: `projects/{project_id}/policies/{constraint_name}` is also an acceptable name for API requests, but responses will return the name using the equivalent project number.\n  - `parent` (`string`): The parent of the resource.\n  - `spec` (`list[obj]`): Basic information about the Organization Policy. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.org_policy_policy.newAttrs` constructs a new object with attributes and blocks configured for the `org_policy_policy`\nTerraform resource.\n\nUnlike [google.org_policy_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Immutable. The resource name of the Policy. Must be one of the following forms, where constraint_name is the name of the constraint which this Policy configures: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}` For example, "projects/123/policies/compute.disableSerialPortAccess". Note: `projects/{project_id}/policies/{constraint_name}` is also an acceptable name for API requests, but responses will return the name using the equivalent project number.\n  - `parent` (`string`): The parent of the resource.\n  - `dry_run_spec` (`list[obj]`): Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it's enforced. When `null`, the `dry_run_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.new](#fn-dry_run_specnew) constructor.\n  - `spec` (`list[obj]`): Basic information about the Organization Policy. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     parent,
+    dry_run_spec=null,
     spec=null,
     timeouts=null
   ):: std.prune(a={
+    dry_run_spec: dry_run_spec,
     name: name,
     parent: parent,
     spec: spec,
@@ -59,7 +115,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           title: title,
         }),
       },
-      '#new':: d.fn(help='\n`google.org_policy_policy.spec.rules.new` constructs a new object with attributes and blocks configured for the `rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_all` (`string`): Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.\n  - `deny_all` (`string`): Setting this to true means that all values are denied. This field can be set only in Policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.\n  - `enforce` (`string`): If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.\n  - `condition` (`list[obj]`): A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')". When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.rules.condition.new](#fn-specspecconditionnew) constructor.\n  - `values` (`list[obj]`): List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.rules.values.new](#fn-specspecvaluesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `rules` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.org_policy_policy.spec.rules.new` constructs a new object with attributes and blocks configured for the `rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_all` (`string`): Setting this to `"TRUE"` means that all values are allowed. This field can be set only in Policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.\n  - `deny_all` (`string`): Setting this to `"TRUE"` means that all values are denied. This field can be set only in Policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.\n  - `enforce` (`string`): If `"TRUE"`, then the `Policy` is enforced. If `"FALSE"`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.\n  - `condition` (`list[obj]`): A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')". When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.rules.condition.new](#fn-specspecconditionnew) constructor.\n  - `values` (`list[obj]`): List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.rules.values.new](#fn-specspecvaluesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `rules` sub block.\n', args=[]),
       new(
         allow_all=null,
         condition=null,
@@ -97,6 +153,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withDryRunSpec':: d.fn(help='`google.list[obj].withDryRunSpec` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dry_run_spec field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDryRunSpecMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dry_run_spec` field.\n', args=[]),
+  withDryRunSpec(resourceLabel, value): {
+    resource+: {
+      google_org_policy_policy+: {
+        [resourceLabel]+: {
+          dry_run_spec: value,
+        },
+      },
+    },
+  },
+  '#withDryRunSpecMixin':: d.fn(help='`google.list[obj].withDryRunSpecMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dry_run_spec field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDryRunSpec](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dry_run_spec` field.\n', args=[]),
+  withDryRunSpecMixin(resourceLabel, value): {
+    resource+: {
+      google_org_policy_policy+: {
+        [resourceLabel]+: {
+          dry_run_spec+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
   withName(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/os_config_patch_deployment.libsonnet b/4.x/_gen/resources/os_config_patch_deployment.libsonnet
index 3ca69dd5..27d5efba 100644
--- a/4.x/_gen/resources/os_config_patch_deployment.libsonnet
+++ b/4.x/_gen/resources/os_config_patch_deployment.libsonnet
@@ -312,12 +312,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         week_day_of_month: week_day_of_month,
       }),
       week_day_of_month:: {
-        '#new':: d.fn(help='\n`google.os_config_patch_deployment.recurring_schedule.monthly.week_day_of_month.new` constructs a new object with attributes and blocks configured for the `week_day_of_month`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week` (`string`): A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]\n  - `week_ordinal` (`number`): Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.\n\n**Returns**:\n  - An attribute object that represents the `week_day_of_month` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.os_config_patch_deployment.recurring_schedule.monthly.week_day_of_month.new` constructs a new object with attributes and blocks configured for the `week_day_of_month`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week` (`string`): A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]\n  - `day_offset` (`number`): Represents the number of days before or after the given week day of month that the patch deployment is scheduled for. When `null`, the `day_offset` field will be omitted from the resulting object.\n  - `week_ordinal` (`number`): Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.\n\n**Returns**:\n  - An attribute object that represents the `week_day_of_month` sub block.\n', args=[]),
         new(
           day_of_week,
-          week_ordinal
+          week_ordinal,
+          day_offset=null
         ):: std.prune(a={
           day_of_week: day_of_week,
+          day_offset: day_offset,
           week_ordinal: week_ordinal,
         }),
       },
diff --git a/4.x/_gen/resources/privateca_ca_pool.libsonnet b/4.x/_gen/resources/privateca_ca_pool.libsonnet
index dc4713e6..0b3fb4af 100644
--- a/4.x/_gen/resources/privateca_ca_pool.libsonnet
+++ b/4.x/_gen/resources/privateca_ca_pool.libsonnet
@@ -228,7 +228,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       maximum_lifetime: maximum_lifetime,
     }),
   },
-  '#new':: d.fn(help="\n`google.privateca_ca_pool.new` injects a new `google_privateca_ca_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_ca_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_ca_pool` using the reference:\n\n    $._ref.google_privateca_ca_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_ca_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: [\u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVOPS\u0026#34;]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_ca_pool.new` injects a new `google_privateca_ca_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_ca_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_ca_pool` using the reference:\n\n    $._ref.google_privateca_ca_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_ca_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: [\u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVOPS\u0026#34;]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -255,7 +255,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_ca_pool.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_ca_pool`\nTerraform resource.\n\nUnlike [google.privateca_ca_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: ["ENTERPRISE", "DEVOPS"]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_ca_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_ca_pool.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_ca_pool`\nTerraform resource.\n\nUnlike [google.privateca_ca_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: ["ENTERPRISE", "DEVOPS"]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_ca_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/privateca_certificate.libsonnet b/4.x/_gen/resources/privateca_certificate.libsonnet
index 5721d30c..f4d0a14e 100644
--- a/4.x/_gen/resources/privateca_certificate.libsonnet
+++ b/4.x/_gen/resources/privateca_certificate.libsonnet
@@ -216,7 +216,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.privateca_certificate.new` injects a new `google_privateca_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate` using the reference:\n\n    $._ref.google_privateca_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca\u0026#39;,\nargument \u0026#39;pool\u0026#39; should be set to \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool\u0026#39;, argument \u0026#39;certificate_authority\u0026#39;\nshould be set to \u0026#39;my-ca\u0026#39;. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format \u0026#39;projects/*/locations/*/certificateTemplates/*\u0026#39;. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_certificate.new` injects a new `google_privateca_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate` using the reference:\n\n    $._ref.google_privateca_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca\u0026#39;,\nargument \u0026#39;pool\u0026#39; should be set to \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool\u0026#39;, argument \u0026#39;certificate_authority\u0026#39;\nshould be set to \u0026#39;my-ca\u0026#39;. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format \u0026#39;projects/*/locations/*/certificateTemplates/*\u0026#39;. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -249,7 +249,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate`\nTerraform resource.\n\nUnlike [google.privateca_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name 'projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca',\nargument 'pool' should be set to 'projects/my-project/locations/us-central1/caPools/my-pool', argument 'certificate_authority'\nshould be set to 'my-ca'. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format 'projects/*/locations/*/certificateTemplates/*'. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate`\nTerraform resource.\n\nUnlike [google.privateca_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name 'projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca',\nargument 'pool' should be set to 'projects/my-project/locations/us-central1/caPools/my-pool', argument 'certificate_authority'\nshould be set to 'my-ca'. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format 'projects/*/locations/*/certificateTemplates/*'. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/privateca_certificate_authority.libsonnet b/4.x/_gen/resources/privateca_certificate_authority.libsonnet
index 79627942..59fb2d88 100644
--- a/4.x/_gen/resources/privateca_certificate_authority.libsonnet
+++ b/4.x/_gen/resources/privateca_certificate_authority.libsonnet
@@ -214,7 +214,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cloud_kms_key_version: cloud_kms_key_version,
     }),
   },
-  '#new':: d.fn(help="\n`google.privateca_certificate_authority.new` injects a new `google_privateca_certificate_authority` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_authority.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_authority` using the reference:\n\n    $._ref.google_privateca_certificate_authority.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_authority.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a \u0026#39;terraform destroy\u0026#39; or \u0026#39;terraform apply\u0026#39; that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to \u0026#39;STAGED\u0026#39; to create a \u0026#39;STAGED\u0026#39; root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as \u0026#39;gs://\u0026#39;) or suffixes (such as \u0026#39;.googleapis.com\u0026#39;). For example, to use a bucket named\nmy-bucket, you would simply specify \u0026#39;my-bucket\u0026#39;. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA\u0026#39;s CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~\u0026gt; **Note:** For \u0026#39;SUBORDINATE\u0026#39; Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: \u0026#34;SELF_SIGNED\u0026#34; Possible values: [\u0026#34;SELF_SIGNED\u0026#34;, \u0026#34;SUBORDINATE\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_certificate_authority.new` injects a new `google_privateca_certificate_authority` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_authority.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_authority` using the reference:\n\n    $._ref.google_privateca_certificate_authority.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_authority.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a \u0026#39;terraform destroy\u0026#39; or \u0026#39;terraform apply\u0026#39; that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to \u0026#39;STAGED\u0026#39; to create a \u0026#39;STAGED\u0026#39; root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as \u0026#39;gs://\u0026#39;) or suffixes (such as \u0026#39;.googleapis.com\u0026#39;). For example, to use a bucket named\nmy-bucket, you would simply specify \u0026#39;my-bucket\u0026#39;. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA\u0026#39;s CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~\u0026gt; **Note:** For \u0026#39;SUBORDINATE\u0026#39; Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: \u0026#34;SELF_SIGNED\u0026#34; Possible values: [\u0026#34;SELF_SIGNED\u0026#34;, \u0026#34;SUBORDINATE\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     certificate_authority_id,
@@ -259,7 +259,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_authority.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_authority`\nTerraform resource.\n\nUnlike [google.privateca_certificate_authority.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a 'terraform destroy' or 'terraform apply' that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to 'STAGED' to create a 'STAGED' root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as 'gs://') or suffixes (such as '.googleapis.com'). For example, to use a bucket named\nmy-bucket, you would simply specify 'my-bucket'. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to 'false'. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA's CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to 'false'. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~> **Note:** For 'SUBORDINATE' Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: "SELF_SIGNED" Possible values: ["SELF_SIGNED", "SUBORDINATE"] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_authority` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_authority.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_authority`\nTerraform resource.\n\nUnlike [google.privateca_certificate_authority.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a 'terraform destroy' or 'terraform apply' that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to 'STAGED' to create a 'STAGED' root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as 'gs://') or suffixes (such as '.googleapis.com'). For example, to use a bucket named\nmy-bucket, you would simply specify 'my-bucket'. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to 'false'. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA's CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to 'false'. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~> **Note:** For 'SUBORDINATE' Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: "SELF_SIGNED" Possible values: ["SELF_SIGNED", "SUBORDINATE"] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_authority` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     certificate_authority_id,
     location,
diff --git a/4.x/_gen/resources/privateca_certificate_template.libsonnet b/4.x/_gen/resources/privateca_certificate_template.libsonnet
index 52bd242d..f7f99cd7 100644
--- a/4.x/_gen/resources/privateca_certificate_template.libsonnet
+++ b/4.x/_gen/resources/privateca_certificate_template.libsonnet
@@ -28,7 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cel_expression: cel_expression,
     }),
   },
-  '#new':: d.fn(help="\n`google.privateca_certificate_template.new` injects a new `google_privateca_certificate_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_template` using the reference:\n\n    $._ref.google_privateca_certificate_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don\u0026#39;t appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool\u0026#39;s IssuancePolicy defines baseline_values that don\u0026#39;t appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate\u0026#39;s predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool\u0026#39;s IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_certificate_template.new` injects a new `google_privateca_certificate_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_template` using the reference:\n\n    $._ref.google_privateca_certificate_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don\u0026#39;t appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool\u0026#39;s IssuancePolicy defines baseline_values that don\u0026#39;t appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate\u0026#39;s predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool\u0026#39;s IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -57,7 +57,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_template.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_template`\nTerraform resource.\n\nUnlike [google.privateca_certificate_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate's identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool's IssuancePolicy defines baseline_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate's predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool's IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_template.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_template`\nTerraform resource.\n\nUnlike [google.privateca_certificate_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate's identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool's IssuancePolicy defines baseline_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate's predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool's IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/project.libsonnet b/4.x/_gen/resources/project.libsonnet
index fd079ffc..134dfb7c 100644
--- a/4.x/_gen/resources/project.libsonnet
+++ b/4.x/_gen/resources/project.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='project', url='', help='`project` represents the `google_project` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.project.new` injects a new `google_project` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.project.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.project` using the reference:\n\n    $._ref.google_project.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_project.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `auto_create_network` (`bool`): Create the \u0026#39;default\u0026#39; network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.project.new` injects a new `google_project` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.project.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.project` using the reference:\n\n    $._ref.google_project.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_project.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `auto_create_network` (`bool`): Create the \u0026#39;default\u0026#39; network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.project.newAttrs` constructs a new object with attributes and blocks configured for the `project`\nTerraform resource.\n\nUnlike [google.project.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `project` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.project.newAttrs` constructs a new object with attributes and blocks configured for the `project`\nTerraform resource.\n\nUnlike [google.project.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `project` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     project_id,
diff --git a/4.x/_gen/resources/pubsub_schema.libsonnet b/4.x/_gen/resources/pubsub_schema.libsonnet
index b2eaed5d..cc812d82 100644
--- a/4.x/_gen/resources/pubsub_schema.libsonnet
+++ b/4.x/_gen/resources/pubsub_schema.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pubsub_schema', url='', help='`pubsub_schema` represents the `google_pubsub_schema` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.pubsub_schema.new` injects a new `google_pubsub_schema` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema` using the reference:\n\n    $._ref.google_pubsub_schema.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema\u0026#39;s resource name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROTOCOL_BUFFER\u0026#34;, \u0026#34;AVRO\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.pubsub_schema.new` injects a new `google_pubsub_schema` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema` using the reference:\n\n    $._ref.google_pubsub_schema.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. Changes\nto the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).\nA schema can only have up to 20 revisions, so updates that fail with an\nerror indicating that the limit has been reached require manually\n[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema\u0026#39;s resource name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROTOCOL_BUFFER\u0026#34;, \u0026#34;AVRO\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.pubsub_schema.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema`\nTerraform resource.\n\nUnlike [google.pubsub_schema.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema`\nTerraform resource.\n\nUnlike [google.pubsub_schema.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. Changes\nto the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).\nA schema can only have up to 20 revisions, so updates that fail with an\nerror indicating that the limit has been reached require manually\n[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     definition=null,
diff --git a/4.x/_gen/resources/pubsub_schema_iam_binding.libsonnet b/4.x/_gen/resources/pubsub_schema_iam_binding.libsonnet
new file mode 100644
index 00000000..e4cc4ba4
--- /dev/null
+++ b/4.x/_gen/resources/pubsub_schema_iam_binding.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_binding', url='', help='`pubsub_schema_iam_binding` represents the `google_pubsub_schema_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.pubsub_schema_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.pubsub_schema_iam_binding.new` injects a new `google_pubsub_schema_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema_iam_binding` using the reference:\n\n    $._ref.google_pubsub_schema_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `schema` (`string`): Set the `schema` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    members,
+    role,
+    schema,
+    condition=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_pubsub_schema_iam_binding',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      members=members,
+      project=project,
+      role=role,
+      schema=schema
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_binding`\nTerraform resource.\n\nUnlike [google.pubsub_schema_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    members,
+    role,
+    schema,
+    condition=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    members: members,
+    project: project,
+    role: role,
+    schema: schema,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
+  withMembers(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          members: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/pubsub_schema_iam_member.libsonnet b/4.x/_gen/resources/pubsub_schema_iam_member.libsonnet
new file mode 100644
index 00000000..a567080c
--- /dev/null
+++ b/4.x/_gen/resources/pubsub_schema_iam_member.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_member', url='', help='`pubsub_schema_iam_member` represents the `google_pubsub_schema_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.pubsub_schema_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.pubsub_schema_iam_member.new` injects a new `google_pubsub_schema_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema_iam_member` using the reference:\n\n    $._ref.google_pubsub_schema_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `schema` (`string`): Set the `schema` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    member,
+    role,
+    schema,
+    condition=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_pubsub_schema_iam_member',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      member=member,
+      project=project,
+      role=role,
+      schema=schema
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_member`\nTerraform resource.\n\nUnlike [google.pubsub_schema_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    member,
+    role,
+    schema,
+    condition=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    member: member,
+    project: project,
+    role: role,
+    schema: schema,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
+  withMember(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          member: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/pubsub_schema_iam_policy.libsonnet b/4.x/_gen/resources/pubsub_schema_iam_policy.libsonnet
new file mode 100644
index 00000000..64def572
--- /dev/null
+++ b/4.x/_gen/resources/pubsub_schema_iam_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_policy', url='', help='`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.pubsub_schema_iam_policy.new` injects a new `google_pubsub_schema_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema_iam_policy` using the reference:\n\n    $._ref.google_pubsub_schema_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting resource block.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    policy_data,
+    schema,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_pubsub_schema_iam_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(policy_data=policy_data, project=project, schema=schema),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`\nTerraform resource.\n\nUnlike [google.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    policy_data,
+    schema,
+    project=null
+  ):: std.prune(a={
+    policy_data: policy_data,
+    project: project,
+    schema: schema,
+  }),
+  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
+  withPolicyData(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_policy+: {
+        [resourceLabel]+: {
+          policy_data: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_policy+: {
+        [resourceLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/pubsub_subscription.libsonnet b/4.x/_gen/resources/pubsub_subscription.libsonnet
index d61eb4a8..26791234 100644
--- a/4.x/_gen/resources/pubsub_subscription.libsonnet
+++ b/4.x/_gen/resources/pubsub_subscription.libsonnet
@@ -3,15 +3,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pubsub_subscription', url='', help='`pubsub_subscription` represents the `google_pubsub_subscription` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   bigquery_config:: {
-    '#new':: d.fn(help='\n`google.pubsub_subscription.bigquery_config.new` constructs a new object with attributes and blocks configured for the `bigquery_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `drop_unknown_fields` (`bool`): When true and useTopicSchema is true, any fields that are a part of the topic schema that are not part of the BigQuery table schema are dropped when writing to BigQuery.\nOtherwise, the schemas must be kept in sync and any messages with extra fields are not written and remain in the subscription's backlog. When `null`, the `drop_unknown_fields` field will be omitted from the resulting object.\n  - `table` (`string`): The name of the table to which to write data, of the form {projectId}:{datasetId}.{tableId}\n  - `use_topic_schema` (`bool`): When true, use the topic's schema as the columns to write to in BigQuery, if it exists. When `null`, the `use_topic_schema` field will be omitted from the resulting object.\n  - `write_metadata` (`bool`): When true, write the subscription name, messageId, publishTime, attributes, and orderingKey to additional columns in the table.\nThe subscription name, messageId, and publishTime fields are put in their own columns while all other message properties (other than data) are written to a JSON object in the attributes column. When `null`, the `write_metadata` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `bigquery_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.pubsub_subscription.bigquery_config.new` constructs a new object with attributes and blocks configured for the `bigquery_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `drop_unknown_fields` (`bool`): When true and use_topic_schema or use_table_schema is true, any fields that are a part of the topic schema or message schema that\nare not part of the BigQuery table schema are dropped when writing to BigQuery. Otherwise, the schemas must be kept in sync\nand any messages with extra fields are not written and remain in the subscription's backlog. When `null`, the `drop_unknown_fields` field will be omitted from the resulting object.\n  - `table` (`string`): The name of the table to which to write data, of the form {projectId}:{datasetId}.{tableId}\n  - `use_table_schema` (`bool`): When true, use the BigQuery table's schema as the columns to write to in BigQuery. Messages\nmust be published in JSON format. Only one of use_topic_schema and use_table_schema can be set. When `null`, the `use_table_schema` field will be omitted from the resulting object.\n  - `use_topic_schema` (`bool`): When true, use the topic's schema as the columns to write to in BigQuery, if it exists.\nOnly one of use_topic_schema and use_table_schema can be set. When `null`, the `use_topic_schema` field will be omitted from the resulting object.\n  - `write_metadata` (`bool`): When true, write the subscription name, messageId, publishTime, attributes, and orderingKey to additional columns in the table.\nThe subscription name, messageId, and publishTime fields are put in their own columns while all other message properties (other than data) are written to a JSON object in the attributes column. When `null`, the `write_metadata` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `bigquery_config` sub block.\n', args=[]),
     new(
       table,
       drop_unknown_fields=null,
+      use_table_schema=null,
       use_topic_schema=null,
       write_metadata=null
     ):: std.prune(a={
       drop_unknown_fields: drop_unknown_fields,
       table: table,
+      use_table_schema: use_table_schema,
       use_topic_schema: use_topic_schema,
       write_metadata: write_metadata,
     }),
@@ -60,7 +62,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       ttl: ttl,
     }),
   },
-  '#new':: d.fn(help="\n`google.pubsub_subscription.new` injects a new `google_pubsub_subscription` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_subscription.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_subscription` using the reference:\n\n    $._ref.google_pubsub_subscription.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_subscription.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If \u0026#39;true\u0026#39;, Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions\u0026#39;:\n\n- The message sent to a subscriber is guaranteed not to be resent before the message\u0026#39;s acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when \u0026#39;enable_exactly_once_delivery\u0026#39;\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If \u0026#39;true\u0026#39;, messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don\u0026#39;t match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can\u0026#39;t modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription\u0026#39;s\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days (\u0026#39;\u0026#34;604800s\u0026#34;\u0026#39;) or less than 10 minutes (\u0026#39;\u0026#34;600s\u0026#34;\u0026#39;).\n\nA duration in seconds with up to nine fractional digits, terminated\nby \u0026#39;s\u0026#39;. Example: \u0026#39;\u0026#34;600.5s\u0026#34;\u0026#39;. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If \u0026#39;true\u0026#39;, then\nmessages are not expunged from the subscription\u0026#39;s backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription\u0026#39;s\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription\u0026#39;s expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is \u0026#34;\u0026#34;, the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.pubsub_subscription.new` injects a new `google_pubsub_subscription` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_subscription.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_subscription` using the reference:\n\n    $._ref.google_pubsub_subscription.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_subscription.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If \u0026#39;true\u0026#39;, Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions\u0026#39;:\n\n- The message sent to a subscriber is guaranteed not to be resent before the message\u0026#39;s acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when \u0026#39;enable_exactly_once_delivery\u0026#39;\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If \u0026#39;true\u0026#39;, messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don\u0026#39;t match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can\u0026#39;t modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription\u0026#39;s\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days (\u0026#39;\u0026#34;604800s\u0026#34;\u0026#39;) or less than 10 minutes (\u0026#39;\u0026#34;600s\u0026#34;\u0026#39;).\n\nA duration in seconds with up to nine fractional digits, terminated\nby \u0026#39;s\u0026#39;. Example: \u0026#39;\u0026#34;600.5s\u0026#34;\u0026#39;. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If \u0026#39;true\u0026#39;, then\nmessages are not expunged from the subscription\u0026#39;s backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource, of the form projects/{project}/topics/{{name}}\n(as in the id property of a google_pubsub_topic), or just a topic name if\nthe topic is in the same project as the subscription.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription\u0026#39;s\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription\u0026#39;s expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is \u0026#34;\u0026#34;, the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -105,7 +107,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.pubsub_subscription.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_subscription`\nTerraform resource.\n\nUnlike [google.pubsub_subscription.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If 'true', Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions':\n\n- The message sent to a subscriber is guaranteed not to be resent before the message's acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when 'enable_exactly_once_delivery'\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If 'true', messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days ('"604800s"') or less than 10 minutes ('"600s"').\n\nA duration in seconds with up to nine fractional digits, terminated\nby 's'. Example: '"600.5s"'. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If 'true', then\nmessages are not expunged from the subscription's backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription's\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription's expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is "", the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_subscription` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_subscription.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_subscription`\nTerraform resource.\n\nUnlike [google.pubsub_subscription.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If 'true', Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions':\n\n- The message sent to a subscriber is guaranteed not to be resent before the message's acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when 'enable_exactly_once_delivery'\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If 'true', messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days ('"604800s"') or less than 10 minutes ('"600s"').\n\nA duration in seconds with up to nine fractional digits, terminated\nby 's'. Example: '"600.5s"'. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If 'true', then\nmessages are not expunged from the subscription's backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource, of the form projects/{project}/topics/{{name}}\n(as in the id property of a google_pubsub_topic), or just a topic name if\nthe topic is in the same project as the subscription.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription's\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription's expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is "", the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_subscription` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     topic,
diff --git a/4.x/_gen/resources/pubsub_topic.libsonnet b/4.x/_gen/resources/pubsub_topic.libsonnet
index 1e052519..a3917152 100644
--- a/4.x/_gen/resources/pubsub_topic.libsonnet
+++ b/4.x/_gen/resources/pubsub_topic.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       allowed_persistence_regions: allowed_persistence_regions,
     }),
   },
-  '#new':: d.fn(help="\n`google.pubsub_topic.new` injects a new `google_pubsub_topic` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_topic.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_topic` using the reference:\n\n    $._ref.google_pubsub_topic.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_topic.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project\u0026#39;s PubSub service account\n(\u0026#39;service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com\u0026#39;) must have\n\u0026#39;roles/cloudkms.cryptoKeyEncrypterDecrypter\u0026#39; to use this feature.\nThe expected format is \u0026#39;projects/*/locations/*/keyRings/*/cryptoKeys/*\u0026#39; When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nCannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.pubsub_topic.new` injects a new `google_pubsub_topic` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_topic.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_topic` using the reference:\n\n    $._ref.google_pubsub_topic.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_topic.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project\u0026#39;s PubSub service account\n(\u0026#39;service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com\u0026#39;) must have\n\u0026#39;roles/cloudkms.cryptoKeyEncrypterDecrypter\u0026#39; to use this feature.\nThe expected format is \u0026#39;projects/*/locations/*/keyRings/*/cryptoKeys/*\u0026#39; When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nThe rotation period has the format of a decimal number, followed by the\nletter \u0026#39;s\u0026#39; (seconds). Cannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.pubsub_topic.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_topic`\nTerraform resource.\n\nUnlike [google.pubsub_topic.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project's PubSub service account\n('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have\n'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.\nThe expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nCannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_topic` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_topic.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_topic`\nTerraform resource.\n\nUnlike [google.pubsub_topic.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project's PubSub service account\n('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have\n'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.\nThe expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nThe rotation period has the format of a decimal number, followed by the\nletter 's' (seconds). Cannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_topic` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     kms_key_name=null,
diff --git a/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet b/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet
index 0a905231..f82bbbb1 100644
--- a/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet
+++ b/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       allowed_bundle_ids: allowed_bundle_ids,
     }),
   },
-  '#new':: d.fn(help="\n`google.recaptcha_enterprise_key.new` injects a new `google_recaptcha_enterprise_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.recaptcha_enterprise_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.recaptcha_enterprise_key` using the reference:\n\n    $._ref.google_recaptcha_enterprise_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_recaptcha_enterprise_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.recaptcha_enterprise_key.new` injects a new `google_recaptcha_enterprise_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.recaptcha_enterprise_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.recaptcha_enterprise_key` using the reference:\n\n    $._ref.google_recaptcha_enterprise_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_recaptcha_enterprise_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `waf_settings` (`list[obj]`): Settings specific to keys that can be used for WAF (Web Application Firewall). When `null`, the `waf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.waf_settings.new](#fn-waf_settingsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -32,6 +32,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     testing_options=null,
     timeouts=null,
+    waf_settings=null,
     web_settings=null,
     _meta={}
   ):: tf.withResource(
@@ -45,11 +46,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       testing_options=testing_options,
       timeouts=timeouts,
+      waf_settings=waf_settings,
       web_settings=web_settings
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.recaptcha_enterprise_key.newAttrs` constructs a new object with attributes and blocks configured for the `recaptcha_enterprise_key`\nTerraform resource.\n\nUnlike [google.recaptcha_enterprise_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `recaptcha_enterprise_key` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.recaptcha_enterprise_key.newAttrs` constructs a new object with attributes and blocks configured for the `recaptcha_enterprise_key`\nTerraform resource.\n\nUnlike [google.recaptcha_enterprise_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `waf_settings` (`list[obj]`): Settings specific to keys that can be used for WAF (Web Application Firewall). When `null`, the `waf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.waf_settings.new](#fn-waf_settingsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `recaptcha_enterprise_key` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     android_settings=null,
@@ -58,6 +60,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     testing_options=null,
     timeouts=null,
+    waf_settings=null,
     web_settings=null
   ):: std.prune(a={
     android_settings: android_settings,
@@ -67,6 +70,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     testing_options: testing_options,
     timeouts: timeouts,
+    waf_settings: waf_settings,
     web_settings: web_settings,
   }),
   testing_options:: {
@@ -91,6 +95,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  waf_settings:: {
+    '#new':: d.fn(help='\n`google.recaptcha_enterprise_key.waf_settings.new` constructs a new object with attributes and blocks configured for the `waf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `waf_feature` (`string`): Supported WAF features. For more information, see https://cloud.google.com/recaptcha-enterprise/docs/usecase#comparison_of_features. Possible values: CHALLENGE_PAGE, SESSION_TOKEN, ACTION_TOKEN, EXPRESS\n  - `waf_service` (`string`): The WAF service that uses this key. Possible values: CA, FASTLY\n\n**Returns**:\n  - An attribute object that represents the `waf_settings` sub block.\n', args=[]),
+    new(
+      waf_feature,
+      waf_service
+    ):: std.prune(a={
+      waf_feature: waf_feature,
+      waf_service: waf_service,
+    }),
+  },
   web_settings:: {
     '#new':: d.fn(help='\n`google.recaptcha_enterprise_key.web_settings.new` constructs a new object with attributes and blocks configured for the `web_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_all_domains` (`bool`): If set to true, it means allowed_domains will not be enforced. When `null`, the `allow_all_domains` field will be omitted from the resulting object.\n  - `allow_amp_traffic` (`bool`): If set to true, the key can be used on AMP (Accelerated Mobile Pages) websites. This is supported only for the SCORE integration type. When `null`, the `allow_amp_traffic` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): Domains or subdomains of websites allowed to use the key. All subdomains of an allowed domain are automatically allowed. A valid domain requires a host and must not include any path, port, query or fragment. Examples: 'example.com' or 'subdomain.example.com' When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `challenge_security_preference` (`string`): Settings for the frequency and difficulty at which this key triggers captcha challenges. This should only be specified for IntegrationTypes CHECKBOX and INVISIBLE. Possible values: CHALLENGE_SECURITY_PREFERENCE_UNSPECIFIED, USABILITY, BALANCE, SECURITY When `null`, the `challenge_security_preference` field will be omitted from the resulting object.\n  - `integration_type` (`string`): Required. Describes how this key is integrated with the website. Possible values: SCORE, CHECKBOX, INVISIBLE\n\n**Returns**:\n  - An attribute object that represents the `web_settings` sub block.\n', args=[]),
     new(
@@ -217,6 +231,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withWafSettings':: d.fn(help='`google.list[obj].withWafSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the waf_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withWafSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `waf_settings` field.\n', args=[]),
+  withWafSettings(resourceLabel, value): {
+    resource+: {
+      google_recaptcha_enterprise_key+: {
+        [resourceLabel]+: {
+          waf_settings: value,
+        },
+      },
+    },
+  },
+  '#withWafSettingsMixin':: d.fn(help='`google.list[obj].withWafSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the waf_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withWafSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `waf_settings` field.\n', args=[]),
+  withWafSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_recaptcha_enterprise_key+: {
+        [resourceLabel]+: {
+          waf_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withWebSettings':: d.fn(help='`google.list[obj].withWebSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the web_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withWebSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `web_settings` field.\n', args=[]),
   withWebSettings(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/redis_cluster.libsonnet b/4.x/_gen/resources/redis_cluster.libsonnet
new file mode 100644
index 00000000..8709de76
--- /dev/null
+++ b/4.x/_gen/resources/redis_cluster.libsonnet
@@ -0,0 +1,186 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='redis_cluster', url='', help='`redis_cluster` represents the `google_redis_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.redis_cluster.new` injects a new `google_redis_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.redis_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.redis_cluster` using the reference:\n\n    $._ref.google_redis_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_redis_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: \u0026#34;AUTH_MODE_DISABLED\u0026#34; Possible values: [\u0026#34;AUTH_MODE_UNSPECIFIED\u0026#34;, \u0026#34;AUTH_MODE_IAM_AUTH\u0026#34;, \u0026#34;AUTH_MODE_DISABLED\u0026#34;] When `null`, the `authorization_mode` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:\nprojects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.\n  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.\nIf not provided, encryption is disabled for the cluster. Default value: \u0026#34;TRANSIT_ENCRYPTION_MODE_DISABLED\u0026#34; Possible values: [\u0026#34;TRANSIT_ENCRYPTION_MODE_UNSPECIFIED\u0026#34;, \u0026#34;TRANSIT_ENCRYPTION_MODE_DISABLED\u0026#34;, \u0026#34;TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION\u0026#34;] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two\nnetwork addresses will be designated to the cluster for client access.\nCurrently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    shard_count,
+    authorization_mode=null,
+    name=null,
+    project=null,
+    psc_configs=null,
+    region=null,
+    replica_count=null,
+    timeouts=null,
+    transit_encryption_mode=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_redis_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      authorization_mode=authorization_mode,
+      name=name,
+      project=project,
+      psc_configs=psc_configs,
+      region=region,
+      replica_count=replica_count,
+      shard_count=shard_count,
+      timeouts=timeouts,
+      transit_encryption_mode=transit_encryption_mode
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.redis_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `redis_cluster`\nTerraform resource.\n\nUnlike [google.redis_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: "AUTH_MODE_DISABLED" Possible values: ["AUTH_MODE_UNSPECIFIED", "AUTH_MODE_IAM_AUTH", "AUTH_MODE_DISABLED"] When `null`, the `authorization_mode` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:\nprojects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.\n  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.\nIf not provided, encryption is disabled for the cluster. Default value: "TRANSIT_ENCRYPTION_MODE_DISABLED" Possible values: ["TRANSIT_ENCRYPTION_MODE_UNSPECIFIED", "TRANSIT_ENCRYPTION_MODE_DISABLED", "TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two\nnetwork addresses will be designated to the cluster for client access.\nCurrently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    shard_count,
+    authorization_mode=null,
+    name=null,
+    project=null,
+    psc_configs=null,
+    region=null,
+    replica_count=null,
+    timeouts=null,
+    transit_encryption_mode=null
+  ):: std.prune(a={
+    authorization_mode: authorization_mode,
+    name: name,
+    project: project,
+    psc_configs: psc_configs,
+    region: region,
+    replica_count: replica_count,
+    shard_count: shard_count,
+    timeouts: timeouts,
+    transit_encryption_mode: transit_encryption_mode,
+  }),
+  psc_configs:: {
+    '#new':: d.fn(help='\n`google.redis_cluster.psc_configs.new` constructs a new object with attributes and blocks configured for the `psc_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. The consumer network where the network address of\nthe discovery endpoint will be reserved, in the form of\nprojects/{network_project_id_or_number}/global/networks/{network_id}.\n\n**Returns**:\n  - An attribute object that represents the `psc_configs` sub block.\n', args=[]),
+    new(
+      network
+    ):: std.prune(a={
+      network: network,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.redis_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAuthorizationMode':: d.fn(help='`google.string.withAuthorizationMode` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the authorization_mode field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `authorization_mode` field.\n', args=[]),
+  withAuthorizationMode(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          authorization_mode: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withPscConfigs':: d.fn(help='`google.list[obj].withPscConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the psc_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPscConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `psc_configs` field.\n', args=[]),
+  withPscConfigs(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          psc_configs: value,
+        },
+      },
+    },
+  },
+  '#withPscConfigsMixin':: d.fn(help='`google.list[obj].withPscConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the psc_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPscConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `psc_configs` field.\n', args=[]),
+  withPscConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          psc_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withReplicaCount':: d.fn(help='`google.number.withReplicaCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the replica_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `replica_count` field.\n', args=[]),
+  withReplicaCount(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          replica_count: value,
+        },
+      },
+    },
+  },
+  '#withShardCount':: d.fn(help='`google.number.withShardCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the shard_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `shard_count` field.\n', args=[]),
+  withShardCount(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          shard_count: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withTransitEncryptionMode':: d.fn(help='`google.string.withTransitEncryptionMode` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the transit_encryption_mode field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `transit_encryption_mode` field.\n', args=[]),
+  withTransitEncryptionMode(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          transit_encryption_mode: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/redis_instance.libsonnet b/4.x/_gen/resources/redis_instance.libsonnet
index c4bbcfb4..b08210d8 100644
--- a/4.x/_gen/resources/redis_instance.libsonnet
+++ b/4.x/_gen/resources/redis_instance.libsonnet
@@ -36,7 +36,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.redis_instance.new` injects a new `google_redis_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.redis_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.redis_instance` using the reference:\n\n    $._ref.google_redis_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_redis_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to \u0026#34;true\u0026#34; AUTH is enabled on the instance.\nDefault value is \u0026#34;false\u0026#34; meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: \u0026#34;DIRECT_PEERING\u0026#34; Possible values: [\u0026#34;DIRECT_PEERING\u0026#34;, \u0026#34;PRIVATE_SERVICE_ACCESS\u0026#34;] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: [\u0026#34;READ_REPLICAS_DISABLED\u0026#34;, \u0026#34;READ_REPLICAS_ENABLED\u0026#34;] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n\u0026#34;auto\u0026#34;. For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or \u0026#34;auto\u0026#34;. When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: \u0026#34;BASIC\u0026#34; Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;STANDARD_HA\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: \u0026#34;DISABLED\u0026#34; Possible values: [\u0026#34;SERVER_AUTHENTICATION\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.redis_instance.new` injects a new `google_redis_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.redis_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.redis_instance` using the reference:\n\n    $._ref.google_redis_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_redis_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to \u0026#34;true\u0026#34; AUTH is enabled on the instance.\nDefault value is \u0026#34;false\u0026#34; meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: \u0026#34;DIRECT_PEERING\u0026#34; Possible values: [\u0026#34;DIRECT_PEERING\u0026#34;, \u0026#34;PRIVATE_SERVICE_ACCESS\u0026#34;] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: [\u0026#34;READ_REPLICAS_DISABLED\u0026#34;, \u0026#34;READ_REPLICAS_ENABLED\u0026#34;] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n\u0026#34;auto\u0026#34;. For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or \u0026#34;auto\u0026#34;. When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: \u0026#34;BASIC\u0026#34; Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;STANDARD_HA\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: \u0026#34;DISABLED\u0026#34; Possible values: [\u0026#34;SERVER_AUTHENTICATION\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     memory_size_gb,
@@ -93,7 +93,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.redis_instance.newAttrs` constructs a new object with attributes and blocks configured for the `redis_instance`\nTerraform resource.\n\nUnlike [google.redis_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to "true" AUTH is enabled on the instance.\nDefault value is "false" meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: "DIRECT_PEERING" Possible values: ["DIRECT_PEERING", "PRIVATE_SERVICE_ACCESS"] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: ["READ_REPLICAS_DISABLED", "READ_REPLICAS_ENABLED"] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n"auto". For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or "auto". When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: "BASIC" Possible values: ["BASIC", "STANDARD_HA"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: "DISABLED" Possible values: ["SERVER_AUTHENTICATION", "DISABLED"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.redis_instance.newAttrs` constructs a new object with attributes and blocks configured for the `redis_instance`\nTerraform resource.\n\nUnlike [google.redis_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to "true" AUTH is enabled on the instance.\nDefault value is "false" meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: "DIRECT_PEERING" Possible values: ["DIRECT_PEERING", "PRIVATE_SERVICE_ACCESS"] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: ["READ_REPLICAS_DISABLED", "READ_REPLICAS_ENABLED"] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n"auto". For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or "auto". When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: "BASIC" Possible values: ["BASIC", "STANDARD_HA"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: "DISABLED" Possible values: ["SERVER_AUTHENTICATION", "DISABLED"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     memory_size_gb,
     name,
diff --git a/4.x/_gen/resources/scc_event_threat_detection_custom_module.libsonnet b/4.x/_gen/resources/scc_event_threat_detection_custom_module.libsonnet
new file mode 100644
index 00000000..d076aec8
--- /dev/null
+++ b/4.x/_gen/resources/scc_event_threat_detection_custom_module.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='scc_event_threat_detection_custom_module', url='', help='`scc_event_threat_detection_custom_module` represents the `google_scc_event_threat_detection_custom_module` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.scc_event_threat_detection_custom_module.new` injects a new `google_scc_event_threat_detection_custom_module` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.scc_event_threat_detection_custom_module.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.scc_event_threat_detection_custom_module` using the reference:\n\n    $._ref.google_scc_event_threat_detection_custom_module.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_scc_event_threat_detection_custom_module.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config` (`string`): Config for the module. For the resident module, its config value is defined at this level.\nFor the inherited module, its config value is inherited from the ancestor module.\n  - `display_name` (`string`): The human readable name to be displayed for the module. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enablement_state` (`string`): The state of enablement for the module at the given level of the hierarchy. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;]\n  - `organization` (`string`): Numerical ID of the parent organization.\n  - `type` (`string`): Immutable. Type for the module. e.g. CONFIGURABLE_BAD_IP.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_event_threat_detection_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    config,
+    enablement_state,
+    organization,
+    type,
+    display_name=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_scc_event_threat_detection_custom_module',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      config=config,
+      display_name=display_name,
+      enablement_state=enablement_state,
+      organization=organization,
+      timeouts=timeouts,
+      type=type
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.scc_event_threat_detection_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_event_threat_detection_custom_module`\nTerraform resource.\n\nUnlike [google.scc_event_threat_detection_custom_module.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config` (`string`): Config for the module. For the resident module, its config value is defined at this level.\nFor the inherited module, its config value is inherited from the ancestor module.\n  - `display_name` (`string`): The human readable name to be displayed for the module. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enablement_state` (`string`): The state of enablement for the module at the given level of the hierarchy. Possible values: ["ENABLED", "DISABLED"]\n  - `organization` (`string`): Numerical ID of the parent organization.\n  - `type` (`string`): Immutable. Type for the module. e.g. CONFIGURABLE_BAD_IP.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_event_threat_detection_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_event_threat_detection_custom_module` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    config,
+    enablement_state,
+    organization,
+    type,
+    display_name=null,
+    timeouts=null
+  ):: std.prune(a={
+    config: config,
+    display_name: display_name,
+    enablement_state: enablement_state,
+    organization: organization,
+    timeouts: timeouts,
+    type: type,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.scc_event_threat_detection_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withConfig':: d.fn(help='`google.string.withConfig` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `config` field.\n', args=[]),
+  withConfig(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          config: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEnablementState':: d.fn(help='`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the enablement_state field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `enablement_state` field.\n', args=[]),
+  withEnablementState(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          enablement_state: value,
+        },
+      },
+    },
+  },
+  '#withOrganization':: d.fn(help='`google.string.withOrganization` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the organization field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `organization` field.\n', args=[]),
+  withOrganization(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          organization: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_scc_event_threat_detection_custom_module+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/scc_folder_custom_module.libsonnet b/4.x/_gen/resources/scc_folder_custom_module.libsonnet
new file mode 100644
index 00000000..70f40acd
--- /dev/null
+++ b/4.x/_gen/resources/scc_folder_custom_module.libsonnet
@@ -0,0 +1,194 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='scc_folder_custom_module', url='', help='`scc_folder_custom_module` represents the `google_scc_folder_custom_module` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  custom_config:: {
+    custom_output:: {
+      '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`\nTerraform sub block.\n\n\n\n**Args**:\n  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_output` sub block.\n', args=[]),
+      new(
+        properties=null
+      ):: std.prune(a={
+        properties: properties,
+      }),
+      properties:: {
+        '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified\nto return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `properties` sub block.\n', args=[]),
+        new(
+          name=null,
+          value_expression=null
+        ):: std.prune(a={
+          name: name,
+          value_expression: value_expression,
+        }),
+        value_expression:: {
+          '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `value_expression` sub block.\n', args=[]),
+          new(
+            expression,
+            description=null,
+            location=null,
+            title=null
+          ):: std.prune(a={
+            description: description,
+            expression: expression,
+            location: location,
+            title: title,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom\nmodule detects. This explanation is returned with each finding instance to\nhelp investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.\n  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve\nthe detected issue. This explanation is returned with each finding generated by\nthis module in the nextSteps property of the finding JSON.\n  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]\n  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.\n  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates\nto true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.\n  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module\ncan specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_config` sub block.\n', args=[]),
+    new(
+      recommendation,
+      severity,
+      custom_output=null,
+      description=null,
+      predicate=null,
+      resource_selector=null
+    ):: std.prune(a={
+      custom_output: custom_output,
+      description: description,
+      predicate: predicate,
+      recommendation: recommendation,
+      resource_selector: resource_selector,
+      severity: severity,
+    }),
+    predicate:: {
+      '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predicate` sub block.\n', args=[]),
+      new(
+        expression,
+        description=null,
+        location=null,
+        title=null
+      ):: std.prune(a={
+        description: description,
+        expression: expression,
+        location: location,
+        title: title,
+      }),
+    },
+    resource_selector:: {
+      '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resource_types` (`list`): The resource types to run the detector on.\n\n**Returns**:\n  - An attribute object that represents the `resource_selector` sub block.\n', args=[]),
+      new(
+        resource_types
+      ):: std.prune(a={
+        resource_types: resource_types,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.scc_folder_custom_module.new` injects a new `google_scc_folder_custom_module` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.scc_folder_custom_module.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.scc_folder_custom_module` using the reference:\n\n    $._ref.google_scc_folder_custom_module.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_scc_folder_custom_module.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;]\n  - `folder` (`string`): Numerical ID of the parent folder.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    display_name,
+    enablement_state,
+    folder,
+    custom_config=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_scc_folder_custom_module',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      custom_config=custom_config,
+      display_name=display_name,
+      enablement_state=enablement_state,
+      folder=folder,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.scc_folder_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_folder_custom_module`\nTerraform resource.\n\nUnlike [google.scc_folder_custom_module.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]\n  - `folder` (`string`): Numerical ID of the parent folder.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_folder_custom_module` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    display_name,
+    enablement_state,
+    folder,
+    custom_config=null,
+    timeouts=null
+  ):: std.prune(a={
+    custom_config: custom_config,
+    display_name: display_name,
+    enablement_state: enablement_state,
+    folder: folder,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.scc_folder_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCustomConfig':: d.fn(help='`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfig(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          custom_config: value,
+        },
+      },
+    },
+  },
+  '#withCustomConfigMixin':: d.fn(help='`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          custom_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEnablementState':: d.fn(help='`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the enablement_state field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `enablement_state` field.\n', args=[]),
+  withEnablementState(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          enablement_state: value,
+        },
+      },
+    },
+  },
+  '#withFolder':: d.fn(help='`google.string.withFolder` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the folder field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `folder` field.\n', args=[]),
+  withFolder(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          folder: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/scc_organization_custom_module.libsonnet b/4.x/_gen/resources/scc_organization_custom_module.libsonnet
new file mode 100644
index 00000000..c35b5f84
--- /dev/null
+++ b/4.x/_gen/resources/scc_organization_custom_module.libsonnet
@@ -0,0 +1,194 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='scc_organization_custom_module', url='', help='`scc_organization_custom_module` represents the `google_scc_organization_custom_module` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  custom_config:: {
+    custom_output:: {
+      '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`\nTerraform sub block.\n\n\n\n**Args**:\n  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_output` sub block.\n', args=[]),
+      new(
+        properties=null
+      ):: std.prune(a={
+        properties: properties,
+      }),
+      properties:: {
+        '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified\nto return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `properties` sub block.\n', args=[]),
+        new(
+          name=null,
+          value_expression=null
+        ):: std.prune(a={
+          name: name,
+          value_expression: value_expression,
+        }),
+        value_expression:: {
+          '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `value_expression` sub block.\n', args=[]),
+          new(
+            expression,
+            description=null,
+            location=null,
+            title=null
+          ):: std.prune(a={
+            description: description,
+            expression: expression,
+            location: location,
+            title: title,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom\nmodule detects. This explanation is returned with each finding instance to\nhelp investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.\n  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve\nthe detected issue. This explanation is returned with each finding generated by\nthis module in the nextSteps property of the finding JSON.\n  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]\n  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.\n  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates\nto true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.\n  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module\ncan specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_config` sub block.\n', args=[]),
+    new(
+      recommendation,
+      severity,
+      custom_output=null,
+      description=null,
+      predicate=null,
+      resource_selector=null
+    ):: std.prune(a={
+      custom_output: custom_output,
+      description: description,
+      predicate: predicate,
+      recommendation: recommendation,
+      resource_selector: resource_selector,
+      severity: severity,
+    }),
+    predicate:: {
+      '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predicate` sub block.\n', args=[]),
+      new(
+        expression,
+        description=null,
+        location=null,
+        title=null
+      ):: std.prune(a={
+        description: description,
+        expression: expression,
+        location: location,
+        title: title,
+      }),
+    },
+    resource_selector:: {
+      '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resource_types` (`list`): The resource types to run the detector on.\n\n**Returns**:\n  - An attribute object that represents the `resource_selector` sub block.\n', args=[]),
+      new(
+        resource_types
+      ):: std.prune(a={
+        resource_types: resource_types,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.scc_organization_custom_module.new` injects a new `google_scc_organization_custom_module` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.scc_organization_custom_module.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.scc_organization_custom_module` using the reference:\n\n    $._ref.google_scc_organization_custom_module.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_scc_organization_custom_module.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;]\n  - `organization` (`string`): Numerical ID of the parent organization.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    display_name,
+    enablement_state,
+    organization,
+    custom_config=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_scc_organization_custom_module',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      custom_config=custom_config,
+      display_name=display_name,
+      enablement_state=enablement_state,
+      organization=organization,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.scc_organization_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_organization_custom_module`\nTerraform resource.\n\nUnlike [google.scc_organization_custom_module.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]\n  - `organization` (`string`): Numerical ID of the parent organization.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_organization_custom_module` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    display_name,
+    enablement_state,
+    organization,
+    custom_config=null,
+    timeouts=null
+  ):: std.prune(a={
+    custom_config: custom_config,
+    display_name: display_name,
+    enablement_state: enablement_state,
+    organization: organization,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.scc_organization_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCustomConfig':: d.fn(help='`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfig(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          custom_config: value,
+        },
+      },
+    },
+  },
+  '#withCustomConfigMixin':: d.fn(help='`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          custom_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEnablementState':: d.fn(help='`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the enablement_state field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `enablement_state` field.\n', args=[]),
+  withEnablementState(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          enablement_state: value,
+        },
+      },
+    },
+  },
+  '#withOrganization':: d.fn(help='`google.string.withOrganization` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the organization field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `organization` field.\n', args=[]),
+  withOrganization(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          organization: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/secret_manager_secret.libsonnet b/4.x/_gen/resources/secret_manager_secret.libsonnet
index 2fc4a616..ef1611f2 100644
--- a/4.x/_gen/resources/secret_manager_secret.libsonnet
+++ b/4.x/_gen/resources/secret_manager_secret.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='secret_manager_secret', url='', help='`secret_manager_secret` represents the `google_secret_manager_secret` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.secret_manager_secret.new` injects a new `google_secret_manager_secret` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secret_manager_secret.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secret_manager_secret` using the reference:\n\n    $._ref.google_secret_manager_secret.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secret_manager_secret.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC \u0026#34;Zulu\u0026#34; format, with nanosecond resolution and up to nine fractional digits. Examples: \u0026#34;2014-10-02T15:01:23Z\u0026#34; and \u0026#34;2014-10-02T15:01:23.045123456Z\u0026#34;. When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore (\u0026#39;_\u0026#39;)\ncharacters. An alias string must start with a letter and cannot be the string\n\u0026#39;latest\u0026#39; or \u0026#39;NEW\u0026#39;. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At \u0026#39;next_rotation_time\u0026#39;, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. \u0026#39;topics\u0026#39; must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.secret_manager_secret.new` injects a new `google_secret_manager_secret` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secret_manager_secret.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secret_manager_secret` using the reference:\n\n    $._ref.google_secret_manager_secret.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secret_manager_secret.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC \u0026#34;Zulu\u0026#34; format, with nanosecond resolution and up to nine fractional digits. Examples: \u0026#34;2014-10-02T15:01:23Z\u0026#34; and \u0026#34;2014-10-02T15:01:23.045123456Z\u0026#34;.\nOnly one of \u0026#39;expire_time\u0026#39; or \u0026#39;ttl\u0026#39; can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;.\nOnly one of \u0026#39;ttl\u0026#39; or \u0026#39;expire_time\u0026#39; can be provided. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore (\u0026#39;_\u0026#39;)\ncharacters. An alias string must start with a letter and cannot be the string\n\u0026#39;latest\u0026#39; or \u0026#39;NEW\u0026#39;. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At \u0026#39;next_rotation_time\u0026#39;, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. \u0026#39;topics\u0026#39; must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     secret_id,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.secret_manager_secret.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secret`\nTerraform resource.\n\nUnlike [google.secret_manager_secret.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')\ncharacters. An alias string must start with a letter and cannot be the string\n'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At 'next_rotation_time', Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. 'topics' must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secret_manager_secret` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.secret_manager_secret.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secret`\nTerraform resource.\n\nUnlike [google.secret_manager_secret.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".\nOnly one of 'expire_time' or 'ttl' can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".\nOnly one of 'ttl' or 'expire_time' can be provided. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')\ncharacters. An alias string must start with a letter and cannot be the string\n'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At 'next_rotation_time', Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. 'topics' must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secret_manager_secret` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     secret_id,
     annotations=null,
@@ -78,14 +78,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         customer_managed_encryption: customer_managed_encryption,
       }),
     },
-    '#new':: d.fn(help='\n`google.secret_manager_secret.replication.new` constructs a new object with attributes and blocks configured for the `replication`\nTerraform sub block.\n\n\n\n**Args**:\n  - `automatic` (`bool`): The Secret will automatically be replicated without any restrictions. When `null`, the `automatic` field will be omitted from the resulting object.\n  - `auto` (`list[obj]`): The Secret will automatically be replicated without any restrictions. When `null`, the `auto` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.auto.new](#fn-replicationautonew) constructor.\n  - `user_managed` (`list[obj]`): The Secret will be replicated to the regions specified by the user. When `null`, the `user_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.user_managed.new](#fn-replicationuser_managednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replication` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.secret_manager_secret.replication.new` constructs a new object with attributes and blocks configured for the `replication`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto` (`list[obj]`): The Secret will automatically be replicated without any restrictions. When `null`, the `auto` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.auto.new](#fn-replicationautonew) constructor.\n  - `user_managed` (`list[obj]`): The Secret will be replicated to the regions specified by the user. When `null`, the `user_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.user_managed.new](#fn-replicationuser_managednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replication` sub block.\n', args=[]),
     new(
       auto=null,
-      automatic=null,
       user_managed=null
     ):: std.prune(a={
       auto: auto,
-      automatic: automatic,
       user_managed: user_managed,
     }),
     user_managed:: {
diff --git a/4.x/_gen/resources/secret_manager_secret_version.libsonnet b/4.x/_gen/resources/secret_manager_secret_version.libsonnet
index 59ba276a..889e4cca 100644
--- a/4.x/_gen/resources/secret_manager_secret_version.libsonnet
+++ b/4.x/_gen/resources/secret_manager_secret_version.libsonnet
@@ -42,13 +42,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.secret_manager_secret_version.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.secret_manager_secret_version.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withDeletionPolicy':: d.fn(help='`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deletion_policy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deletion_policy` field.\n', args=[]),
diff --git a/4.x/_gen/resources/secure_source_manager_instance.libsonnet b/4.x/_gen/resources/secure_source_manager_instance.libsonnet
new file mode 100644
index 00000000..ba535fe9
--- /dev/null
+++ b/4.x/_gen/resources/secure_source_manager_instance.libsonnet
@@ -0,0 +1,160 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secure_source_manager_instance', url='', help='`secure_source_manager_instance` represents the `google_secure_source_manager_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.secure_source_manager_instance.new` injects a new `google_secure_source_manager_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secure_source_manager_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secure_source_manager_instance` using the reference:\n\n    $._ref.google_secure_source_manager_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secure_source_manager_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `instance_id` (`string`): The name for the Instance.\n  - `kms_key` (`string`): Customer-managed encryption key name, in the format projects/*/locations/*/keyRings/*/cryptoKeys/*. When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the Instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `private_config` (`list[obj]`): Private settings for private instance. When `null`, the `private_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.private_config.new](#fn-private_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    instance_id,
+    location,
+    kms_key=null,
+    labels=null,
+    private_config=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_secure_source_manager_instance',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      instance_id=instance_id,
+      kms_key=kms_key,
+      labels=labels,
+      location=location,
+      private_config=private_config,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.secure_source_manager_instance.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance`\nTerraform resource.\n\nUnlike [google.secure_source_manager_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_id` (`string`): The name for the Instance.\n  - `kms_key` (`string`): Customer-managed encryption key name, in the format projects/*/locations/*/keyRings/*/cryptoKeys/*. When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels as key value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the Instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `private_config` (`list[obj]`): Private settings for private instance. When `null`, the `private_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.private_config.new](#fn-private_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    instance_id,
+    location,
+    kms_key=null,
+    labels=null,
+    private_config=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    instance_id: instance_id,
+    kms_key: kms_key,
+    labels: labels,
+    location: location,
+    private_config: private_config,
+    project: project,
+    timeouts: timeouts,
+  }),
+  private_config:: {
+    '#new':: d.fn(help='\n`google.secure_source_manager_instance.private_config.new` constructs a new object with attributes and blocks configured for the `private_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ca_pool` (`string`): CA pool resource, resource must in the format of 'projects/{project}/locations/{location}/caPools/{ca_pool}'.\n  - `is_private` (`bool`): 'Indicate if it's private instance.'\n\n**Returns**:\n  - An attribute object that represents the `private_config` sub block.\n', args=[]),
+    new(
+      ca_pool,
+      is_private
+    ):: std.prune(a={
+      ca_pool: ca_pool,
+      is_private: is_private,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.secure_source_manager_instance.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withInstanceId':: d.fn(help='`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the instance_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `instance_id` field.\n', args=[]),
+  withInstanceId(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          instance_id: value,
+        },
+      },
+    },
+  },
+  '#withKmsKey':: d.fn(help='`google.string.withKmsKey` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kms_key field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kms_key` field.\n', args=[]),
+  withKmsKey(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          kms_key: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withPrivateConfig':: d.fn(help='`google.list[obj].withPrivateConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the private_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPrivateConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `private_config` field.\n', args=[]),
+  withPrivateConfig(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          private_config: value,
+        },
+      },
+    },
+  },
+  '#withPrivateConfigMixin':: d.fn(help='`google.list[obj].withPrivateConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the private_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPrivateConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `private_config` field.\n', args=[]),
+  withPrivateConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          private_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/secure_source_manager_instance_iam_binding.libsonnet b/4.x/_gen/resources/secure_source_manager_instance_iam_binding.libsonnet
new file mode 100644
index 00000000..40a0eea1
--- /dev/null
+++ b/4.x/_gen/resources/secure_source_manager_instance_iam_binding.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secure_source_manager_instance_iam_binding', url='', help='`secure_source_manager_instance_iam_binding` represents the `google_secure_source_manager_instance_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.secure_source_manager_instance_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.secure_source_manager_instance_iam_binding.new` injects a new `google_secure_source_manager_instance_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secure_source_manager_instance_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secure_source_manager_instance_iam_binding` using the reference:\n\n    $._ref.google_secure_source_manager_instance_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secure_source_manager_instance_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    instance_id,
+    members,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_secure_source_manager_instance_iam_binding',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      instance_id=instance_id,
+      location=location,
+      members=members,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.secure_source_manager_instance_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_binding`\nTerraform resource.\n\nUnlike [google.secure_source_manager_instance_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    instance_id,
+    members,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    instance_id: instance_id,
+    location: location,
+    members: members,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withInstanceId':: d.fn(help='`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the instance_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `instance_id` field.\n', args=[]),
+  withInstanceId(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          instance_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
+  withMembers(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          members: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_binding+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/secure_source_manager_instance_iam_member.libsonnet b/4.x/_gen/resources/secure_source_manager_instance_iam_member.libsonnet
new file mode 100644
index 00000000..f28c1012
--- /dev/null
+++ b/4.x/_gen/resources/secure_source_manager_instance_iam_member.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secure_source_manager_instance_iam_member', url='', help='`secure_source_manager_instance_iam_member` represents the `google_secure_source_manager_instance_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.secure_source_manager_instance_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.secure_source_manager_instance_iam_member.new` injects a new `google_secure_source_manager_instance_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secure_source_manager_instance_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secure_source_manager_instance_iam_member` using the reference:\n\n    $._ref.google_secure_source_manager_instance_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secure_source_manager_instance_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    instance_id,
+    member,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_secure_source_manager_instance_iam_member',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      instance_id=instance_id,
+      location=location,
+      member=member,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.secure_source_manager_instance_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_member`\nTerraform resource.\n\nUnlike [google.secure_source_manager_instance_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    instance_id,
+    member,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    instance_id: instance_id,
+    location: location,
+    member: member,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withInstanceId':: d.fn(help='`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the instance_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `instance_id` field.\n', args=[]),
+  withInstanceId(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          instance_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
+  withMember(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          member: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_member+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/secure_source_manager_instance_iam_policy.libsonnet b/4.x/_gen/resources/secure_source_manager_instance_iam_policy.libsonnet
new file mode 100644
index 00000000..7a1caeca
--- /dev/null
+++ b/4.x/_gen/resources/secure_source_manager_instance_iam_policy.libsonnet
@@ -0,0 +1,76 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secure_source_manager_instance_iam_policy', url='', help='`secure_source_manager_instance_iam_policy` represents the `google_secure_source_manager_instance_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.secure_source_manager_instance_iam_policy.new` injects a new `google_secure_source_manager_instance_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secure_source_manager_instance_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secure_source_manager_instance_iam_policy` using the reference:\n\n    $._ref.google_secure_source_manager_instance_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secure_source_manager_instance_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    instance_id,
+    policy_data,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_secure_source_manager_instance_iam_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      instance_id=instance_id,
+      location=location,
+      policy_data=policy_data,
+      project=project
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.secure_source_manager_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_policy`\nTerraform resource.\n\nUnlike [google.secure_source_manager_instance_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    instance_id,
+    policy_data,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    instance_id: instance_id,
+    location: location,
+    policy_data: policy_data,
+    project: project,
+  }),
+  '#withInstanceId':: d.fn(help='`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the instance_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `instance_id` field.\n', args=[]),
+  withInstanceId(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [resourceLabel]+: {
+          instance_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
+  withPolicyData(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [resourceLabel]+: {
+          policy_data: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_secure_source_manager_instance_iam_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/securityposture_posture.libsonnet b/4.x/_gen/resources/securityposture_posture.libsonnet
new file mode 100644
index 00000000..e49784f3
--- /dev/null
+++ b/4.x/_gen/resources/securityposture_posture.libsonnet
@@ -0,0 +1,414 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='securityposture_posture', url='', help='`securityposture_posture` represents the `google_securityposture_posture` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.securityposture_posture.new` injects a new `google_securityposture_posture` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.securityposture_posture.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.securityposture_posture` using the reference:\n\n    $._ref.google_securityposture_posture.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_securityposture_posture.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the posture. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the resource, eg: global.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be \u0026#39;organizations/{organization_id}\u0026#39;.\n  - `posture_id` (`string`): Id of the posture. It is an immutable field.\n  - `state` (`string`): State of the posture. Update to state field should not be triggered along with\nwith other field updates. Possible values: [\u0026#34;DEPRECATED\u0026#34;, \u0026#34;DRAFT\u0026#34;, \u0026#34;ACTIVE\u0026#34;]\n  - `policy_sets` (`list[obj]`): List of policy sets for the posture. When `null`, the `policy_sets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.new](#fn-policy_setsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    parent,
+    posture_id,
+    state,
+    description=null,
+    policy_sets=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_securityposture_posture',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      location=location,
+      parent=parent,
+      policy_sets=policy_sets,
+      posture_id=posture_id,
+      state=state,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.securityposture_posture.newAttrs` constructs a new object with attributes and blocks configured for the `securityposture_posture`\nTerraform resource.\n\nUnlike [google.securityposture_posture.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the posture. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the resource, eg: global.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.\n  - `posture_id` (`string`): Id of the posture. It is an immutable field.\n  - `state` (`string`): State of the posture. Update to state field should not be triggered along with\nwith other field updates. Possible values: ["DEPRECATED", "DRAFT", "ACTIVE"]\n  - `policy_sets` (`list[obj]`): List of policy sets for the posture. When `null`, the `policy_sets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.new](#fn-policy_setsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `securityposture_posture` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    parent,
+    posture_id,
+    state,
+    description=null,
+    policy_sets=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    location: location,
+    parent: parent,
+    policy_sets: policy_sets,
+    posture_id: posture_id,
+    state: state,
+    timeouts: timeouts,
+  }),
+  policy_sets:: {
+    '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.new` constructs a new object with attributes and blocks configured for the `policy_sets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the policy set. When `null`, the `description` field will be omitted from the resulting object.\n  - `policy_set_id` (`string`): ID of the policy set.\n  - `policies` (`list[obj]`): List of security policy When `null`, the `policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.new](#fn-policy_setspoliciesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_sets` sub block.\n', args=[]),
+    new(
+      policy_set_id,
+      description=null,
+      policies=null
+    ):: std.prune(a={
+      description: description,
+      policies: policies,
+      policy_set_id: policy_set_id,
+    }),
+    policies:: {
+      compliance_standards:: {
+        '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.compliance_standards.new` constructs a new object with attributes and blocks configured for the `compliance_standards`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control` (`string`): Mapping of security controls for the policy. When `null`, the `control` field will be omitted from the resulting object.\n  - `standard` (`string`): Mapping of compliance standards for the policy. When `null`, the `standard` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `compliance_standards` sub block.\n', args=[]),
+        new(
+          control=null,
+          standard=null
+        ):: std.prune(a={
+          control: control,
+          standard: standard,
+        }),
+      },
+      constraint:: {
+        '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.new` constructs a new object with attributes and blocks configured for the `constraint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `org_policy_constraint` (`list[obj]`): Organization policy canned constraint definition. When `null`, the `org_policy_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.new](#fn-policy_setspolicy_setspoliciesorg_policy_constraintnew) constructor.\n  - `org_policy_constraint_custom` (`list[obj]`): Organization policy custom constraint policy definition. When `null`, the `org_policy_constraint_custom` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.new](#fn-policy_setspolicy_setspoliciesorg_policy_constraint_customnew) constructor.\n  - `security_health_analytics_custom_module` (`list[obj]`): Definition of Security Health Analytics Custom Module. When `null`, the `security_health_analytics_custom_module` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.new](#fn-policy_setspolicy_setspoliciessecurity_health_analytics_custom_modulenew) constructor.\n  - `security_health_analytics_module` (`list[obj]`): Security Health Analytics built-in detector definition. When `null`, the `security_health_analytics_module` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_module.new](#fn-policy_setspolicy_setspoliciessecurity_health_analytics_modulenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `constraint` sub block.\n', args=[]),
+        new(
+          org_policy_constraint=null,
+          org_policy_constraint_custom=null,
+          security_health_analytics_custom_module=null,
+          security_health_analytics_module=null
+        ):: std.prune(a={
+          org_policy_constraint: org_policy_constraint,
+          org_policy_constraint_custom: org_policy_constraint_custom,
+          security_health_analytics_custom_module: security_health_analytics_custom_module,
+          security_health_analytics_module: security_health_analytics_module,
+        }),
+        org_policy_constraint:: {
+          '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.new` constructs a new object with attributes and blocks configured for the `org_policy_constraint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `canned_constraint_id` (`string`): Organization policy canned constraint Id\n  - `policy_rules` (`list[obj]`): Definition of policy rules When `null`, the `policy_rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.new](#fn-policy_setspolicy_setspoliciesconstraintpolicy_rulesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `org_policy_constraint` sub block.\n', args=[]),
+          new(
+            canned_constraint_id,
+            policy_rules=null
+          ):: std.prune(a={
+            canned_constraint_id: canned_constraint_id,
+            policy_rules: policy_rules,
+          }),
+          policy_rules:: {
+            expr:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr.new` constructs a new object with attributes and blocks configured for the `expr`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `expr` sub block.\n', args=[]),
+              new(
+                expression,
+                description=null,
+                location=null,
+                title=null
+              ):: std.prune(a={
+                description: description,
+                expression: expression,
+                location: location,
+                title: title,
+              }),
+            },
+            '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.new` constructs a new object with attributes and blocks configured for the `policy_rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_all` (`bool`): Setting this to true means that all values are allowed. This field can be set only in policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.\n  - `deny_all` (`bool`): Setting this to true means that all values are denied. This field can be set only in policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.\n  - `enforce` (`bool`): If 'true', then the policy is enforced. If 'false', then any configuration is acceptable.\nThis field can be set only in policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.\n  - `expr` (`list[obj]`): Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language.\nThis page details the objects and attributes that are used to the build the CEL expressions for\ncustom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. When `null`, the `expr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraintexprnew) constructor.\n  - `values` (`list[obj]`): List of values to be used for this policy rule. This field can be set only in policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.values.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraintvaluesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_rules` sub block.\n', args=[]),
+            new(
+              allow_all=null,
+              deny_all=null,
+              enforce=null,
+              expr=null,
+              values=null
+            ):: std.prune(a={
+              allow_all: allow_all,
+              deny_all: deny_all,
+              enforce: enforce,
+              expr: expr,
+              values: values,
+            }),
+            values:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.values.new` constructs a new object with attributes and blocks configured for the `values`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_values` (`list`): List of values allowed at this resource. When `null`, the `allowed_values` field will be omitted from the resulting object.\n  - `denied_values` (`list`): List of values denied at this resource. When `null`, the `denied_values` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `values` sub block.\n', args=[]),
+              new(
+                allowed_values=null,
+                denied_values=null
+              ):: std.prune(a={
+                allowed_values: allowed_values,
+                denied_values: denied_values,
+              }),
+            },
+          },
+        },
+        org_policy_constraint_custom:: {
+          custom_constraint:: {
+            '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint.new` constructs a new object with attributes and blocks configured for the `custom_constraint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]\n  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).\n  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).\n  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.\n  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.\n\n**Returns**:\n  - An attribute object that represents the `custom_constraint` sub block.\n', args=[]),
+            new(
+              action_type,
+              condition,
+              method_types,
+              name,
+              resource_types,
+              description=null,
+              display_name=null
+            ):: std.prune(a={
+              action_type: action_type,
+              condition: condition,
+              description: description,
+              display_name: display_name,
+              method_types: method_types,
+              name: name,
+              resource_types: resource_types,
+            }),
+          },
+          '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.new` constructs a new object with attributes and blocks configured for the `org_policy_constraint_custom`\nTerraform sub block.\n\n\n\n**Args**:\n  - `custom_constraint` (`list[obj]`): Organization policy custom constraint definition. When `null`, the `custom_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint.new](#fn-policy_setspolicy_setspoliciesconstraintcustom_constraintnew) constructor.\n  - `policy_rules` (`list[obj]`): Definition of policy rules When `null`, the `policy_rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.new](#fn-policy_setspolicy_setspoliciesconstraintpolicy_rulesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `org_policy_constraint_custom` sub block.\n', args=[]),
+          new(
+            custom_constraint=null,
+            policy_rules=null
+          ):: std.prune(a={
+            custom_constraint: custom_constraint,
+            policy_rules: policy_rules,
+          }),
+          policy_rules:: {
+            expr:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr.new` constructs a new object with attributes and blocks configured for the `expr`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `expr` sub block.\n', args=[]),
+              new(
+                expression,
+                description=null,
+                location=null,
+                title=null
+              ):: std.prune(a={
+                description: description,
+                expression: expression,
+                location: location,
+                title: title,
+              }),
+            },
+            '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.new` constructs a new object with attributes and blocks configured for the `policy_rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_all` (`bool`): Setting this to true means that all values are allowed. This field can be set only in policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.\n  - `deny_all` (`bool`): Setting this to true means that all values are denied. This field can be set only in policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.\n  - `enforce` (`bool`): If 'true', then the policy is enforced. If 'false', then any configuration is acceptable.\nThis field can be set only in policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.\n  - `expr` (`list[obj]`): Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language.\nThis page details the objects and attributes that are used to the build the CEL expressions for\ncustom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. When `null`, the `expr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraint_customexprnew) constructor.\n  - `values` (`list[obj]`): List of values to be used for this policy rule. This field can be set only in policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraint_customvaluesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policy_rules` sub block.\n', args=[]),
+            new(
+              allow_all=null,
+              deny_all=null,
+              enforce=null,
+              expr=null,
+              values=null
+            ):: std.prune(a={
+              allow_all: allow_all,
+              deny_all: deny_all,
+              enforce: enforce,
+              expr: expr,
+              values: values,
+            }),
+            values:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values.new` constructs a new object with attributes and blocks configured for the `values`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_values` (`list`): List of values allowed at this resource. When `null`, the `allowed_values` field will be omitted from the resulting object.\n  - `denied_values` (`list`): List of values denied at this resource. When `null`, the `denied_values` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `values` sub block.\n', args=[]),
+              new(
+                allowed_values=null,
+                denied_values=null
+              ):: std.prune(a={
+                allowed_values: allowed_values,
+                denied_values: denied_values,
+              }),
+            },
+          },
+        },
+        security_health_analytics_custom_module:: {
+          config:: {
+            custom_output:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`\nTerraform sub block.\n\n\n\n**Args**:\n  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigpropertiesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_output` sub block.\n', args=[]),
+              new(
+                properties=null
+              ):: std.prune(a={
+                properties: properties,
+              }),
+              properties:: {
+                '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the property for the custom output.\n  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be\nspecified to return the value of the property or a text string enclosed\nin quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputvalue_expressionnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `properties` sub block.\n', args=[]),
+                new(
+                  name,
+                  value_expression=null
+                ):: std.prune(a={
+                  name: name,
+                  value_expression: value_expression,
+                }),
+                value_expression:: {
+                  '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `value_expression` sub block.\n', args=[]),
+                  new(
+                    expression,
+                    description=null,
+                    location=null,
+                    title=null
+                  ):: std.prune(a={
+                    description: description,
+                    expression: expression,
+                    location: location,
+                    title: title,
+                  }),
+                },
+              },
+            },
+            '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom\nmodule detects. When `null`, the `description` field will be omitted from the resulting object.\n  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to\nresolve the detected issue When `null`, the `recommendation` field will be omitted from the resulting object.\n  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["SEVERITY_UNSPECIFIED", "CRITICAL", "HIGH", "MEDIUM", "LOW"]\n  - `custom_output` (`list[obj]`): Custom output properties. A set of optional name-value pairs that define custom source properties to\nreturn with each finding that is generated by the custom module. The custom\nsource properties that are defined here are included in the finding JSON\nunder 'sourceProperties'. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_modulecustom_outputnew) constructor.\n  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings.When the expression\nevaluates to true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_modulepredicatenew) constructor.\n  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module\ncan specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_moduleresource_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
+            new(
+              severity,
+              custom_output=null,
+              description=null,
+              predicate=null,
+              recommendation=null,
+              resource_selector=null
+            ):: std.prune(a={
+              custom_output: custom_output,
+              description: description,
+              predicate: predicate,
+              recommendation: recommendation,
+              resource_selector: resource_selector,
+              severity: severity,
+            }),
+            predicate:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predicate` sub block.\n', args=[]),
+              new(
+                expression,
+                description=null,
+                location=null,
+                title=null
+              ):: std.prune(a={
+                description: description,
+                expression: expression,
+                location: location,
+                title: title,
+              }),
+            },
+            resource_selector:: {
+              '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resource_types` (`list`): The resource types to run the detector on.\n\n**Returns**:\n  - An attribute object that represents the `resource_selector` sub block.\n', args=[]),
+              new(
+                resource_types
+              ):: std.prune(a={
+                resource_types: resource_types,
+              }),
+            },
+          },
+          '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.new` constructs a new object with attributes and blocks configured for the `security_health_analytics_custom_module`\nTerraform sub block.\n\n\n\n**Args**:\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `module_enablement_state` (`string`): The state of enablement for the module at its level of the resource hierarchy. Possible values: ["ENABLEMENT_STATE_UNSPECIFIED", "ENABLED", "DISABLED"] When `null`, the `module_enablement_state` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Custom module details. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.new](#fn-policy_setspolicy_setspoliciesconstraintconfignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `security_health_analytics_custom_module` sub block.\n', args=[]),
+          new(
+            config=null,
+            display_name=null,
+            module_enablement_state=null
+          ):: std.prune(a={
+            config: config,
+            display_name: display_name,
+            module_enablement_state: module_enablement_state,
+          }),
+        },
+        security_health_analytics_module:: {
+          '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_module.new` constructs a new object with attributes and blocks configured for the `security_health_analytics_module`\nTerraform sub block.\n\n\n\n**Args**:\n  - `module_enablement_state` (`string`): The state of enablement for the module at its level of the resource hierarchy. Possible values: ["ENABLEMENT_STATE_UNSPECIFIED", "ENABLED", "DISABLED"] When `null`, the `module_enablement_state` field will be omitted from the resulting object.\n  - `module_name` (`string`): The name of the module eg: BIGQUERY_TABLE_CMEK_DISABLED.\n\n**Returns**:\n  - An attribute object that represents the `security_health_analytics_module` sub block.\n', args=[]),
+          new(
+            module_name,
+            module_enablement_state=null
+          ):: std.prune(a={
+            module_enablement_state: module_enablement_state,
+            module_name: module_name,
+          }),
+        },
+      },
+      '#new':: d.fn(help='\n`google.securityposture_posture.policy_sets.policies.new` constructs a new object with attributes and blocks configured for the `policies`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the policy. When `null`, the `description` field will be omitted from the resulting object.\n  - `policy_id` (`string`): ID of the policy.\n  - `compliance_standards` (`list[obj]`): Mapping for policy to security standards and controls. When `null`, the `compliance_standards` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.compliance_standards.new](#fn-policy_setspolicy_setscompliance_standardsnew) constructor.\n  - `constraint` (`list[obj]`): Policy constraint definition.It can have the definition of one of following constraints: orgPolicyConstraint orgPolicyConstraintCustom securityHealthAnalyticsModule securityHealthAnalyticsCustomModule When `null`, the `constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.new](#fn-policy_setspolicy_setsconstraintnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `policies` sub block.\n', args=[]),
+      new(
+        policy_id,
+        compliance_standards=null,
+        constraint=null,
+        description=null
+      ):: std.prune(a={
+        compliance_standards: compliance_standards,
+        constraint: constraint,
+        description: description,
+        policy_id: policy_id,
+      }),
+    },
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.securityposture_posture.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withPolicySets':: d.fn(help='`google.list[obj].withPolicySets` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the policy_sets field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPolicySetsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `policy_sets` field.\n', args=[]),
+  withPolicySets(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          policy_sets: value,
+        },
+      },
+    },
+  },
+  '#withPolicySetsMixin':: d.fn(help='`google.list[obj].withPolicySetsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the policy_sets field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPolicySets](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `policy_sets` field.\n', args=[]),
+  withPolicySetsMixin(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          policy_sets+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withPostureId':: d.fn(help='`google.string.withPostureId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the posture_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `posture_id` field.\n', args=[]),
+  withPostureId(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          posture_id: value,
+        },
+      },
+    },
+  },
+  '#withState':: d.fn(help='`google.string.withState` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the state field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `state` field.\n', args=[]),
+  withState(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          state: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/securityposture_posture_deployment.libsonnet b/4.x/_gen/resources/securityposture_posture_deployment.libsonnet
new file mode 100644
index 00000000..668edb66
--- /dev/null
+++ b/4.x/_gen/resources/securityposture_posture_deployment.libsonnet
@@ -0,0 +1,154 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='securityposture_posture_deployment', url='', help='`securityposture_posture_deployment` represents the `google_securityposture_posture_deployment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.securityposture_posture_deployment.new` injects a new `google_securityposture_posture_deployment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.securityposture_posture_deployment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.securityposture_posture_deployment` using the reference:\n\n    $._ref.google_securityposture_posture_deployment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_securityposture_posture_deployment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the posture deployment. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource, eg. global\u0026#39;.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be \u0026#39;organizations/{organization_id}\u0026#39;.\n  - `posture_deployment_id` (`string`): ID of the posture deployment.\n  - `posture_id` (`string`): Relative name of the posture which needs to be deployed. It should be in the format:\n  organizations/\u0026lt;ORG_ID\u0026gt;/locations/\u0026lt;LOCATION\u0026gt;/postures/\u0026lt;postureID\u0026gt;\n  - `posture_revision_id` (`string`): Revision_id the posture which needs to be deployed.\n  - `target_resource` (`string`): The resource on which the posture should be deployed. This can be in one of the following formats:\nprojects/\u0026lt;project_number\u0026gt;\nfolders/\u0026lt;folder_number\u0026gt;\norganizations/\u0026lt;organization_id\u0026gt;\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture_deployment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    parent,
+    posture_deployment_id,
+    posture_id,
+    posture_revision_id,
+    target_resource,
+    description=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_securityposture_posture_deployment',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      location=location,
+      parent=parent,
+      posture_deployment_id=posture_deployment_id,
+      posture_id=posture_id,
+      posture_revision_id=posture_revision_id,
+      target_resource=target_resource,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.securityposture_posture_deployment.newAttrs` constructs a new object with attributes and blocks configured for the `securityposture_posture_deployment`\nTerraform resource.\n\nUnlike [google.securityposture_posture_deployment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the posture deployment. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource, eg. global'.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.\n  - `posture_deployment_id` (`string`): ID of the posture deployment.\n  - `posture_id` (`string`): Relative name of the posture which needs to be deployed. It should be in the format:\n  organizations/<ORG_ID>/locations/<LOCATION>/postures/<postureID>\n  - `posture_revision_id` (`string`): Revision_id the posture which needs to be deployed.\n  - `target_resource` (`string`): The resource on which the posture should be deployed. This can be in one of the following formats:\nprojects/<project_number>\nfolders/<folder_number>\norganizations/<organization_id>\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture_deployment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `securityposture_posture_deployment` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    parent,
+    posture_deployment_id,
+    posture_id,
+    posture_revision_id,
+    target_resource,
+    description=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    location: location,
+    parent: parent,
+    posture_deployment_id: posture_deployment_id,
+    posture_id: posture_id,
+    posture_revision_id: posture_revision_id,
+    target_resource: target_resource,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.securityposture_posture_deployment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withPostureDeploymentId':: d.fn(help='`google.string.withPostureDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the posture_deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `posture_deployment_id` field.\n', args=[]),
+  withPostureDeploymentId(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          posture_deployment_id: value,
+        },
+      },
+    },
+  },
+  '#withPostureId':: d.fn(help='`google.string.withPostureId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the posture_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `posture_id` field.\n', args=[]),
+  withPostureId(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          posture_id: value,
+        },
+      },
+    },
+  },
+  '#withPostureRevisionId':: d.fn(help='`google.string.withPostureRevisionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the posture_revision_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `posture_revision_id` field.\n', args=[]),
+  withPostureRevisionId(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          posture_revision_id: value,
+        },
+      },
+    },
+  },
+  '#withTargetResource':: d.fn(help='`google.string.withTargetResource` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the target_resource field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `target_resource` field.\n', args=[]),
+  withTargetResource(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          target_resource: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_securityposture_posture_deployment+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/service_account.libsonnet b/4.x/_gen/resources/service_account.libsonnet
index 27495606..58a05c13 100644
--- a/4.x/_gen/resources/service_account.libsonnet
+++ b/4.x/_gen/resources/service_account.libsonnet
@@ -2,10 +2,11 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='service_account', url='', help='`service_account` represents the `google_service_account` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.service_account.new` injects a new `google_service_account` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.service_account.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.service_account` using the reference:\n\n    $._ref.google_service_account.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_service_account.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `account_id` (`string`): The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035. Changing this forces a new service account to be created.\n  - `description` (`string`): A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the service account is disabled. Defaults to false When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the service account. Can be updated without creating a new resource. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project that the service account will be created in. Defaults to the provider project configuration. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_account.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.service_account.new` injects a new `google_service_account` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.service_account.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.service_account` using the reference:\n\n    $._ref.google_service_account.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_service_account.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `account_id` (`string`): The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035. Changing this forces a new service account to be created.\n  - `create_ignore_already_exists` (`bool`): If set to true, skip service account creation if a service account with the same email already exists. When `null`, the `create_ignore_already_exists` field will be omitted from the resulting object.\n  - `description` (`string`): A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the service account is disabled. Defaults to false When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the service account. Can be updated without creating a new resource. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project that the service account will be created in. Defaults to the provider project configuration. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_account.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     account_id,
+    create_ignore_already_exists=null,
     description=null,
     disabled=null,
     display_name=null,
@@ -17,6 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       account_id=account_id,
+      create_ignore_already_exists=create_ignore_already_exists,
       description=description,
       disabled=disabled,
       display_name=display_name,
@@ -25,9 +27,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.service_account.newAttrs` constructs a new object with attributes and blocks configured for the `service_account`\nTerraform resource.\n\nUnlike [google.service_account.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `account_id` (`string`): The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035. Changing this forces a new service account to be created.\n  - `description` (`string`): A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the service account is disabled. Defaults to false When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the service account. Can be updated without creating a new resource. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project that the service account will be created in. Defaults to the provider project configuration. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_account.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `service_account` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.service_account.newAttrs` constructs a new object with attributes and blocks configured for the `service_account`\nTerraform resource.\n\nUnlike [google.service_account.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `account_id` (`string`): The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035. Changing this forces a new service account to be created.\n  - `create_ignore_already_exists` (`bool`): If set to true, skip service account creation if a service account with the same email already exists. When `null`, the `create_ignore_already_exists` field will be omitted from the resulting object.\n  - `description` (`string`): A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `disabled` (`bool`): Whether the service account is disabled. Defaults to false When `null`, the `disabled` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the service account. Can be updated without creating a new resource. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project that the service account will be created in. Defaults to the provider project configuration. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_account.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `service_account` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     account_id,
+    create_ignore_already_exists=null,
     description=null,
     disabled=null,
     display_name=null,
@@ -35,6 +38,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts=null
   ):: std.prune(a={
     account_id: account_id,
+    create_ignore_already_exists: create_ignore_already_exists,
     description: description,
     disabled: disabled,
     display_name: display_name,
@@ -59,6 +63,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withCreateIgnoreAlreadyExists':: d.fn(help='`google.bool.withCreateIgnoreAlreadyExists` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the create_ignore_already_exists field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `create_ignore_already_exists` field.\n', args=[]),
+  withCreateIgnoreAlreadyExists(resourceLabel, value): {
+    resource+: {
+      google_service_account+: {
+        [resourceLabel]+: {
+          create_ignore_already_exists: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/service_networking_connection.libsonnet b/4.x/_gen/resources/service_networking_connection.libsonnet
index 8bb6202c..d3342382 100644
--- a/4.x/_gen/resources/service_networking_connection.libsonnet
+++ b/4.x/_gen/resources/service_networking_connection.libsonnet
@@ -2,18 +2,20 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='service_networking_connection', url='', help='`service_networking_connection` represents the `google_service_networking_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.service_networking_connection.new` injects a new `google_service_networking_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.service_networking_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.service_networking_connection` using the reference:\n\n    $._ref.google_service_networking_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_service_networking_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `network` (`string`): Name of VPC network connected with service producers using VPC peering.\n  - `reserved_peering_ranges` (`list`): Named IP address range(s) of PEERING type reserved for this service provider. Note that invoking this method with a different range when connection is already established will not reallocate already provisioned service producer subnetworks.\n  - `service` (`string`): Provider peering service that is managing peering connectivity for a service provider organization. For Google services that support this functionality it is \u0026#39;servicenetworking.googleapis.com\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_networking_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.service_networking_connection.new` injects a new `google_service_networking_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.service_networking_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.service_networking_connection` using the reference:\n\n    $._ref.google_service_networking_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_service_networking_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_policy` (`string`): When set to ABANDON, terraform will abandon management of the resource instead of deleting it. Prevents terraform apply failures with CloudSQL. Note: The resource will still exist. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `network` (`string`): Name of VPC network connected with service producers using VPC peering.\n  - `reserved_peering_ranges` (`list`): Named IP address range(s) of PEERING type reserved for this service provider. Note that invoking this method with a different range when connection is already established will not reallocate already provisioned service producer subnetworks.\n  - `service` (`string`): Provider peering service that is managing peering connectivity for a service provider organization. For Google services that support this functionality it is \u0026#39;servicenetworking.googleapis.com\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_networking_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     network,
     reserved_peering_ranges,
     service,
+    deletion_policy=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
     type='google_service_networking_connection',
     label=resourceLabel,
     attrs=self.newAttrs(
+      deletion_policy=deletion_policy,
       network=network,
       reserved_peering_ranges=reserved_peering_ranges,
       service=service,
@@ -21,13 +23,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.service_networking_connection.newAttrs` constructs a new object with attributes and blocks configured for the `service_networking_connection`\nTerraform resource.\n\nUnlike [google.service_networking_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `network` (`string`): Name of VPC network connected with service producers using VPC peering.\n  - `reserved_peering_ranges` (`list`): Named IP address range(s) of PEERING type reserved for this service provider. Note that invoking this method with a different range when connection is already established will not reallocate already provisioned service producer subnetworks.\n  - `service` (`string`): Provider peering service that is managing peering connectivity for a service provider organization. For Google services that support this functionality it is 'servicenetworking.googleapis.com'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_networking_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `service_networking_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.service_networking_connection.newAttrs` constructs a new object with attributes and blocks configured for the `service_networking_connection`\nTerraform resource.\n\nUnlike [google.service_networking_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_policy` (`string`): When set to ABANDON, terraform will abandon management of the resource instead of deleting it. Prevents terraform apply failures with CloudSQL. Note: The resource will still exist. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `network` (`string`): Name of VPC network connected with service producers using VPC peering.\n  - `reserved_peering_ranges` (`list`): Named IP address range(s) of PEERING type reserved for this service provider. Note that invoking this method with a different range when connection is already established will not reallocate already provisioned service producer subnetworks.\n  - `service` (`string`): Provider peering service that is managing peering connectivity for a service provider organization. For Google services that support this functionality it is 'servicenetworking.googleapis.com'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.service_networking_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `service_networking_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     network,
     reserved_peering_ranges,
     service,
+    deletion_policy=null,
     timeouts=null
   ):: std.prune(a={
+    deletion_policy: deletion_policy,
     network: network,
     reserved_peering_ranges: reserved_peering_ranges,
     service: service,
@@ -45,6 +49,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withDeletionPolicy':: d.fn(help='`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deletion_policy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deletion_policy` field.\n', args=[]),
+  withDeletionPolicy(resourceLabel, value): {
+    resource+: {
+      google_service_networking_connection+: {
+        [resourceLabel]+: {
+          deletion_policy: value,
+        },
+      },
+    },
+  },
   '#withNetwork':: d.fn(help='`google.string.withNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `network` field.\n', args=[]),
   withNetwork(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/spanner_instance.libsonnet b/4.x/_gen/resources/spanner_instance.libsonnet
index f7da38f7..9d2c380d 100644
--- a/4.x/_gen/resources/spanner_instance.libsonnet
+++ b/4.x/_gen/resources/spanner_instance.libsonnet
@@ -2,11 +2,46 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='spanner_instance', url='', help='`spanner_instance` represents the `google_spanner_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.spanner_instance.new` injects a new `google_spanner_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.spanner_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.spanner_instance` using the reference:\n\n    $._ref.google_spanner_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_spanner_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config` (`string`): The name of the instance\u0026#39;s configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form \u0026#39;regional-europe-west1\u0026#39; , \u0026#39;us-central\u0026#39; etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with \u0026#39;tf-\u0026#39; will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  autoscaling_config:: {
+    autoscaling_limits:: {
+      '#new':: d.fn(help='\n`google.spanner_instance.autoscaling_config.autoscaling_limits.new` constructs a new object with attributes and blocks configured for the `autoscaling_limits`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_nodes` (`number`): Specifies maximum number of nodes allocated to the instance. If set, this number\nshould be greater than or equal to min_nodes. When `null`, the `max_nodes` field will be omitted from the resulting object.\n  - `max_processing_units` (`number`): Specifies maximum number of processing units allocated to the instance.\nIf set, this number should be multiples of 1000 and be greater than or equal to\nmin_processing_units. When `null`, the `max_processing_units` field will be omitted from the resulting object.\n  - `min_nodes` (`number`): Specifies number of nodes allocated to the instance. If set, this number\nshould be greater than or equal to 1. When `null`, the `min_nodes` field will be omitted from the resulting object.\n  - `min_processing_units` (`number`): Specifies minimum number of processing units allocated to the instance.\nIf set, this number should be multiples of 1000. When `null`, the `min_processing_units` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `autoscaling_limits` sub block.\n', args=[]),
+      new(
+        max_nodes=null,
+        max_processing_units=null,
+        min_nodes=null,
+        min_processing_units=null
+      ):: std.prune(a={
+        max_nodes: max_nodes,
+        max_processing_units: max_processing_units,
+        min_nodes: min_nodes,
+        min_processing_units: min_processing_units,
+      }),
+    },
+    autoscaling_targets:: {
+      '#new':: d.fn(help='\n`google.spanner_instance.autoscaling_config.autoscaling_targets.new` constructs a new object with attributes and blocks configured for the `autoscaling_targets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `high_priority_cpu_utilization_percent` (`number`): Specifies the target high priority cpu utilization percentage that the autoscaler\nshould be trying to achieve for the instance.\nThis number is on a scale from 0 (no utilization) to 100 (full utilization).. When `null`, the `high_priority_cpu_utilization_percent` field will be omitted from the resulting object.\n  - `storage_utilization_percent` (`number`): Specifies the target storage utilization percentage that the autoscaler\nshould be trying to achieve for the instance.\nThis number is on a scale from 0 (no utilization) to 100 (full utilization). When `null`, the `storage_utilization_percent` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `autoscaling_targets` sub block.\n', args=[]),
+      new(
+        high_priority_cpu_utilization_percent=null,
+        storage_utilization_percent=null
+      ):: std.prune(a={
+        high_priority_cpu_utilization_percent: high_priority_cpu_utilization_percent,
+        storage_utilization_percent: storage_utilization_percent,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.spanner_instance.autoscaling_config.new` constructs a new object with attributes and blocks configured for the `autoscaling_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `autoscaling_limits` (`list[obj]`): Defines scale in controls to reduce the risk of response latency\nand outages due to abrupt scale-in events. Users can define the minimum and\nmaximum compute capacity allocated to the instance, and the autoscaler will\nonly scale within that range. Users can either use nodes or processing\nunits to specify the limits, but should use the same unit to set both the\nmin_limit and max_limit. When `null`, the `autoscaling_limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.autoscaling_limits.new](#fn-autoscaling_configautoscaling_limitsnew) constructor.\n  - `autoscaling_targets` (`list[obj]`): Defines scale in controls to reduce the risk of response latency\nand outages due to abrupt scale-in events When `null`, the `autoscaling_targets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.autoscaling_targets.new](#fn-autoscaling_configautoscaling_targetsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `autoscaling_config` sub block.\n', args=[]),
+    new(
+      autoscaling_limits=null,
+      autoscaling_targets=null
+    ):: std.prune(a={
+      autoscaling_limits: autoscaling_limits,
+      autoscaling_targets: autoscaling_targets,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.spanner_instance.new` injects a new `google_spanner_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.spanner_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.spanner_instance` using the reference:\n\n    $._ref.google_spanner_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_spanner_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config` (`string`): The name of the instance\u0026#39;s configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form \u0026#39;regional-europe-west1\u0026#39; , \u0026#39;us-central\u0026#39; etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with \u0026#39;tf-\u0026#39; will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `autoscaling_config` (`list[obj]`): The autoscaling configuration. Autoscaling is enabled if this field is set.\nWhen autoscaling is enabled, num_nodes and processing_units are treated as,\nOUTPUT_ONLY fields and reflect the current compute capacity allocated to\nthe instance. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.new](#fn-autoscaling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     config,
     display_name,
+    autoscaling_config=null,
     force_destroy=null,
     labels=null,
     name=null,
@@ -19,6 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_spanner_instance',
     label=resourceLabel,
     attrs=self.newAttrs(
+      autoscaling_config=autoscaling_config,
       config=config,
       display_name=display_name,
       force_destroy=force_destroy,
@@ -31,10 +67,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.spanner_instance.newAttrs` constructs a new object with attributes and blocks configured for the `spanner_instance`\nTerraform resource.\n\nUnlike [google.spanner_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config` (`string`): The name of the instance's configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form 'regional-europe-west1' , 'us-central' etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with 'tf-' will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `spanner_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.spanner_instance.newAttrs` constructs a new object with attributes and blocks configured for the `spanner_instance`\nTerraform resource.\n\nUnlike [google.spanner_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config` (`string`): The name of the instance's configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form 'regional-europe-west1' , 'us-central' etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with 'tf-' will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `autoscaling_config` (`list[obj]`): The autoscaling configuration. Autoscaling is enabled if this field is set.\nWhen autoscaling is enabled, num_nodes and processing_units are treated as,\nOUTPUT_ONLY fields and reflect the current compute capacity allocated to\nthe instance. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.new](#fn-autoscaling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `spanner_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     config,
     display_name,
+    autoscaling_config=null,
     force_destroy=null,
     labels=null,
     name=null,
@@ -43,6 +80,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     timeouts=null
   ):: std.prune(a={
+    autoscaling_config: autoscaling_config,
     config: config,
     display_name: display_name,
     force_destroy: force_destroy,
@@ -65,6 +103,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAutoscalingConfig':: d.fn(help='`google.list[obj].withAutoscalingConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the autoscaling_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAutoscalingConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `autoscaling_config` field.\n', args=[]),
+  withAutoscalingConfig(resourceLabel, value): {
+    resource+: {
+      google_spanner_instance+: {
+        [resourceLabel]+: {
+          autoscaling_config: value,
+        },
+      },
+    },
+  },
+  '#withAutoscalingConfigMixin':: d.fn(help='`google.list[obj].withAutoscalingConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the autoscaling_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAutoscalingConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `autoscaling_config` field.\n', args=[]),
+  withAutoscalingConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_spanner_instance+: {
+        [resourceLabel]+: {
+          autoscaling_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withConfig':: d.fn(help='`google.string.withConfig` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `config` field.\n', args=[]),
   withConfig(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/sql_database_instance.libsonnet b/4.x/_gen/resources/sql_database_instance.libsonnet
index 7c64a0d5..1e1663a1 100644
--- a/4.x/_gen/resources/sql_database_instance.libsonnet
+++ b/4.x/_gen/resources/sql_database_instance.libsonnet
@@ -3,16 +3,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='sql_database_instance', url='', help='`sql_database_instance` represents the `google_sql_database_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   clone:: {
-    '#new':: d.fn(help='\n`google.sql_database_instance.clone.new` constructs a new object with attributes and blocks configured for the `clone`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.\n  - `database_names` (`list`): (SQL Server only, use with point_in_time) clone only the specified databases from the source instance. Clone all databases if empty. When `null`, the `database_names` field will be omitted from the resulting object.\n  - `point_in_time` (`string`): The timestamp of the point in time that should be restored. When `null`, the `point_in_time` field will be omitted from the resulting object.\n  - `source_instance_name` (`string`): The name of the instance from which the point in time should be restored.\n\n**Returns**:\n  - An attribute object that represents the `clone` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.sql_database_instance.clone.new` constructs a new object with attributes and blocks configured for the `clone`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.\n  - `database_names` (`list`): (SQL Server only, use with point_in_time) clone only the specified databases from the source instance. Clone all databases if empty. When `null`, the `database_names` field will be omitted from the resulting object.\n  - `point_in_time` (`string`): The timestamp of the point in time that should be restored. When `null`, the `point_in_time` field will be omitted from the resulting object.\n  - `preferred_zone` (`string`): (Point-in-time recovery for PostgreSQL only) Clone to an instance in the specified zone. If no zone is specified, clone to the same zone as the source instance. When `null`, the `preferred_zone` field will be omitted from the resulting object.\n  - `source_instance_name` (`string`): The name of the instance from which the point in time should be restored.\n\n**Returns**:\n  - An attribute object that represents the `clone` sub block.\n', args=[]),
     new(
       source_instance_name,
       allocated_ip_range=null,
       database_names=null,
-      point_in_time=null
+      point_in_time=null,
+      preferred_zone=null
     ):: std.prune(a={
       allocated_ip_range: allocated_ip_range,
       database_names: database_names,
       point_in_time: point_in_time,
+      preferred_zone: preferred_zone,
       source_instance_name: source_instance_name,
     }),
   },
@@ -237,7 +239,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           value: value,
         }),
       },
-      '#new':: d.fn(help='\n`google.sql_database_instance.settings.ip_configuration.new` constructs a new object with attributes and blocks configured for the `ip_configuration`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the instance ip will be created in the allocated range. The range name must comply with RFC 1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.\n  - `enable_private_path_for_google_cloud_services` (`bool`): Whether Google Cloud services such as BigQuery are allowed to access data in this Cloud SQL instance over a private IP connection. SQLSERVER database type is not supported. When `null`, the `enable_private_path_for_google_cloud_services` field will be omitted from the resulting object.\n  - `ipv4_enabled` (`bool`): Whether this Cloud SQL instance should be assigned a public IPV4 address. At least ipv4_enabled must be enabled or a private_network must be configured. When `null`, the `ipv4_enabled` field will be omitted from the resulting object.\n  - `private_network` (`string`): The VPC network from which the Cloud SQL instance is accessible for private IP. For example, projects/myProject/global/networks/default. Specifying a network enables private IP. At least ipv4_enabled must be enabled or a private_network must be configured. This setting can be updated, but it cannot be removed after it is set. When `null`, the `private_network` field will be omitted from the resulting object.\n  - `require_ssl` (`bool`): Set the `require_ssl` field on the resulting object. When `null`, the `require_ssl` field will be omitted from the resulting object.\n  - `authorized_networks` (`list[obj]`): Set the `authorized_networks` field on the resulting object. When `null`, the `authorized_networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_database_instance.settings.ip_configuration.authorized_networks.new](#fn-settingssettingsauthorized_networksnew) constructor.\n  - `psc_config` (`list[obj]`): PSC settings for a Cloud SQL instance. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_database_instance.settings.ip_configuration.psc_config.new](#fn-settingssettingspsc_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ip_configuration` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.sql_database_instance.settings.ip_configuration.new` constructs a new object with attributes and blocks configured for the `ip_configuration`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the instance ip will be created in the allocated range. The range name must comply with RFC 1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.\n  - `enable_private_path_for_google_cloud_services` (`bool`): Whether Google Cloud services such as BigQuery are allowed to access data in this Cloud SQL instance over a private IP connection. SQLSERVER database type is not supported. When `null`, the `enable_private_path_for_google_cloud_services` field will be omitted from the resulting object.\n  - `ipv4_enabled` (`bool`): Whether this Cloud SQL instance should be assigned a public IPV4 address. At least ipv4_enabled must be enabled or a private_network must be configured. When `null`, the `ipv4_enabled` field will be omitted from the resulting object.\n  - `private_network` (`string`): The VPC network from which the Cloud SQL instance is accessible for private IP. For example, projects/myProject/global/networks/default. Specifying a network enables private IP. At least ipv4_enabled must be enabled or a private_network must be configured. This setting can be updated, but it cannot be removed after it is set. When `null`, the `private_network` field will be omitted from the resulting object.\n  - `require_ssl` (`bool`): Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in ssl_mode if it has been set too. When `null`, the `require_ssl` field will be omitted from the resulting object.\n  - `ssl_mode` (`string`): Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to require_ssl. To change this field, also set the correspoding value in require_ssl. When `null`, the `ssl_mode` field will be omitted from the resulting object.\n  - `authorized_networks` (`list[obj]`): Set the `authorized_networks` field on the resulting object. When `null`, the `authorized_networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_database_instance.settings.ip_configuration.authorized_networks.new](#fn-settingssettingsauthorized_networksnew) constructor.\n  - `psc_config` (`list[obj]`): PSC settings for a Cloud SQL instance. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_database_instance.settings.ip_configuration.psc_config.new](#fn-settingssettingspsc_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ip_configuration` sub block.\n', args=[]),
       new(
         allocated_ip_range=null,
         authorized_networks=null,
@@ -245,7 +247,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         ipv4_enabled=null,
         private_network=null,
         psc_config=null,
-        require_ssl=null
+        require_ssl=null,
+        ssl_mode=null
       ):: std.prune(a={
         allocated_ip_range: allocated_ip_range,
         authorized_networks: authorized_networks,
@@ -254,6 +257,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         private_network: private_network,
         psc_config: psc_config,
         require_ssl: require_ssl,
+        ssl_mode: ssl_mode,
       }),
       psc_config:: {
         '#new':: d.fn(help='\n`google.sql_database_instance.settings.ip_configuration.psc_config.new` constructs a new object with attributes and blocks configured for the `psc_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_consumer_projects` (`list`): List of consumer projects that are allow-listed for PSC connections to this instance. This instance can be connected to with PSC from any network in these projects. Each consumer project in this list may be represented by a project number (numeric) or by a project id (alphanumeric). When `null`, the `allowed_consumer_projects` field will be omitted from the resulting object.\n  - `psc_enabled` (`bool`): Whether PSC connectivity is enabled for this instance. When `null`, the `psc_enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `psc_config` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/sql_source_representation_instance.libsonnet b/4.x/_gen/resources/sql_source_representation_instance.libsonnet
index 5923e06c..2debf336 100644
--- a/4.x/_gen/resources/sql_source_representation_instance.libsonnet
+++ b/4.x/_gen/resources/sql_source_representation_instance.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='sql_source_representation_instance', url='', help='`sql_source_representation_instance` represents the `google_sql_source_representation_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.sql_source_representation_instance.new` injects a new `google_sql_source_representation_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.sql_source_representation_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.sql_source_representation_instance` using the reference:\n\n    $._ref.google_sql_source_representation_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_sql_source_representation_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: [\u0026#34;MYSQL_5_6\u0026#34;, \u0026#34;MYSQL_5_7\u0026#34;, \u0026#34;MYSQL_8_0\u0026#34;, \u0026#34;POSTGRES_9_6\u0026#34;, \u0026#34;POSTGRES_10\u0026#34;, \u0026#34;POSTGRES_11\u0026#34;, \u0026#34;POSTGRES_12\u0026#34;, \u0026#34;POSTGRES_13\u0026#34;, \u0026#34;POSTGRES_14\u0026#34;]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The externally accessible IPv4 address for the source database server.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.sql_source_representation_instance.new` injects a new `google_sql_source_representation_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.sql_source_representation_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.sql_source_representation_instance` using the reference:\n\n    $._ref.google_sql_source_representation_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_sql_source_representation_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: [\u0026#34;MYSQL_5_6\u0026#34;, \u0026#34;MYSQL_5_7\u0026#34;, \u0026#34;MYSQL_8_0\u0026#34;, \u0026#34;POSTGRES_9_6\u0026#34;, \u0026#34;POSTGRES_10\u0026#34;, \u0026#34;POSTGRES_11\u0026#34;, \u0026#34;POSTGRES_12\u0026#34;, \u0026#34;POSTGRES_13\u0026#34;, \u0026#34;POSTGRES_14\u0026#34;]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     database_version,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.sql_source_representation_instance.newAttrs` constructs a new object with attributes and blocks configured for the `sql_source_representation_instance`\nTerraform resource.\n\nUnlike [google.sql_source_representation_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The externally accessible IPv4 address for the source database server.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `sql_source_representation_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.sql_source_representation_instance.newAttrs` constructs a new object with attributes and blocks configured for the `sql_source_representation_instance`\nTerraform resource.\n\nUnlike [google.sql_source_representation_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `sql_source_representation_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     database_version,
     host,
diff --git a/4.x/_gen/resources/sql_user.libsonnet b/4.x/_gen/resources/sql_user.libsonnet
index e7a14306..717d4936 100644
--- a/4.x/_gen/resources/sql_user.libsonnet
+++ b/4.x/_gen/resources/sql_user.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='sql_user', url='', help='`sql_user` represents the `google_sql_user` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.sql_user.new` injects a new `google_sql_user` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.sql_user.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.sql_user` using the reference:\n\n    $._ref.google_sql_user.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_sql_user.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_policy` (`string`): The deletion policy for the user. Setting ABANDON allows the resource\n\t\t\t\tto be abandoned rather than deleted. This is useful for Postgres, where users cannot be deleted from the API if they\n\t\t\t\thave been granted SQL roles. Possible values are: \u0026#34;ABANDON\u0026#34;. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `host` (`string`): The host the user can connect from. This is only supported for MySQL instances. Don\u0026#39;t set this field for PostgreSQL instances. Can be an IP address. Changing this forces a new resource to be created. When `null`, the `host` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the Cloud SQL instance. Changing this forces a new resource to be created.\n  - `name` (`string`): The name of the user. Changing this forces a new resource to be created.\n  - `password` (`string`): The password for the user. Can be updated. For Postgres instances this is a Required field, unless type is set to\n                either CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT. When `null`, the `password` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The user type. It determines the method to authenticate the user during login.\n                The default is the database\u0026#39;s built-in user type. Flags include \u0026#34;BUILT_IN\u0026#34;, \u0026#34;CLOUD_IAM_USER\u0026#34;, or \u0026#34;CLOUD_IAM_SERVICE_ACCOUNT\u0026#34;. When `null`, the `type` field will be omitted from the resulting object.\n  - `password_policy` (`list[obj]`): Set the `password_policy` field on the resulting resource block. When `null`, the `password_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.password_policy.new](#fn-password_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.sql_user.new` injects a new `google_sql_user` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.sql_user.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.sql_user` using the reference:\n\n    $._ref.google_sql_user.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_sql_user.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_policy` (`string`): The deletion policy for the user. Setting ABANDON allows the resource\n\t\t\t\tto be abandoned rather than deleted. This is useful for Postgres, where users cannot be deleted from the API if they\n\t\t\t\thave been granted SQL roles. Possible values are: \u0026#34;ABANDON\u0026#34;. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `host` (`string`): The host the user can connect from. This is only supported for MySQL instances. Don\u0026#39;t set this field for PostgreSQL instances. Can be an IP address. Changing this forces a new resource to be created. When `null`, the `host` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the Cloud SQL instance. Changing this forces a new resource to be created.\n  - `name` (`string`): The name of the user. Changing this forces a new resource to be created.\n  - `password` (`string`): The password for the user. Can be updated. For Postgres instances this is a Required field, unless type is set to\n                either CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT. When `null`, the `password` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The user type. It determines the method to authenticate the user during login.\n                The default is the database\u0026#39;s built-in user type. Flags include \u0026#34;BUILT_IN\u0026#34;, \u0026#34;CLOUD_IAM_USER\u0026#34;, \u0026#34;CLOUD_IAM_GROUP\u0026#34; or \u0026#34;CLOUD_IAM_SERVICE_ACCOUNT\u0026#34;. When `null`, the `type` field will be omitted from the resulting object.\n  - `password_policy` (`list[obj]`): Set the `password_policy` field on the resulting resource block. When `null`, the `password_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.password_policy.new](#fn-password_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     instance,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.sql_user.newAttrs` constructs a new object with attributes and blocks configured for the `sql_user`\nTerraform resource.\n\nUnlike [google.sql_user.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_policy` (`string`): The deletion policy for the user. Setting ABANDON allows the resource\n\t\t\t\tto be abandoned rather than deleted. This is useful for Postgres, where users cannot be deleted from the API if they\n\t\t\t\thave been granted SQL roles. Possible values are: "ABANDON". When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `host` (`string`): The host the user can connect from. This is only supported for MySQL instances. Don't set this field for PostgreSQL instances. Can be an IP address. Changing this forces a new resource to be created. When `null`, the `host` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the Cloud SQL instance. Changing this forces a new resource to be created.\n  - `name` (`string`): The name of the user. Changing this forces a new resource to be created.\n  - `password` (`string`): The password for the user. Can be updated. For Postgres instances this is a Required field, unless type is set to\n                either CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT. When `null`, the `password` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The user type. It determines the method to authenticate the user during login.\n                The default is the database's built-in user type. Flags include "BUILT_IN", "CLOUD_IAM_USER", or "CLOUD_IAM_SERVICE_ACCOUNT". When `null`, the `type` field will be omitted from the resulting object.\n  - `password_policy` (`list[obj]`): Set the `password_policy` field on the resulting object. When `null`, the `password_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.password_policy.new](#fn-password_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `sql_user` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.sql_user.newAttrs` constructs a new object with attributes and blocks configured for the `sql_user`\nTerraform resource.\n\nUnlike [google.sql_user.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_policy` (`string`): The deletion policy for the user. Setting ABANDON allows the resource\n\t\t\t\tto be abandoned rather than deleted. This is useful for Postgres, where users cannot be deleted from the API if they\n\t\t\t\thave been granted SQL roles. Possible values are: "ABANDON". When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `host` (`string`): The host the user can connect from. This is only supported for MySQL instances. Don't set this field for PostgreSQL instances. Can be an IP address. Changing this forces a new resource to be created. When `null`, the `host` field will be omitted from the resulting object.\n  - `instance` (`string`): The name of the Cloud SQL instance. Changing this forces a new resource to be created.\n  - `name` (`string`): The name of the user. Changing this forces a new resource to be created.\n  - `password` (`string`): The password for the user. Can be updated. For Postgres instances this is a Required field, unless type is set to\n                either CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT. When `null`, the `password` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The user type. It determines the method to authenticate the user during login.\n                The default is the database's built-in user type. Flags include "BUILT_IN", "CLOUD_IAM_USER", "CLOUD_IAM_GROUP" or "CLOUD_IAM_SERVICE_ACCOUNT". When `null`, the `type` field will be omitted from the resulting object.\n  - `password_policy` (`list[obj]`): Set the `password_policy` field on the resulting object. When `null`, the `password_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.password_policy.new](#fn-password_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `sql_user` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     instance,
     name,
diff --git a/4.x/_gen/resources/storage_bucket.libsonnet b/4.x/_gen/resources/storage_bucket.libsonnet
index cf5410b9..b17347cb 100644
--- a/4.x/_gen/resources/storage_bucket.libsonnet
+++ b/4.x/_gen/resources/storage_bucket.libsonnet
@@ -3,11 +3,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='storage_bucket', url='', help='`storage_bucket` represents the `google_storage_bucket` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   autoclass:: {
-    '#new':: d.fn(help='\n`google.storage_bucket.autoclass.new` constructs a new object with attributes and blocks configured for the `autoclass`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.\n\n**Returns**:\n  - An attribute object that represents the `autoclass` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.storage_bucket.autoclass.new` constructs a new object with attributes and blocks configured for the `autoclass`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.\n  - `terminal_storage_class` (`string`): The storage class that objects in the bucket eventually transition to if they are not read for a certain length of time. Supported values include: NEARLINE, ARCHIVE. When `null`, the `terminal_storage_class` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `autoclass` sub block.\n', args=[]),
     new(
-      enabled
+      enabled,
+      terminal_storage_class=null
     ):: std.prune(a={
       enabled: enabled,
+      terminal_storage_class: terminal_storage_class,
     }),
   },
   cors:: {
@@ -52,7 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     condition:: {
-      '#new':: d.fn(help='\n`google.storage_bucket.lifecycle_rule.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `age` (`number`): Minimum age of an object in days to satisfy this condition. When `null`, the `age` field will be omitted from the resulting object.\n  - `created_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `created_before` field will be omitted from the resulting object.\n  - `custom_time_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `custom_time_before` field will be omitted from the resulting object.\n  - `days_since_custom_time` (`number`): Number of days elapsed since the user-specified timestamp set on an object. When `null`, the `days_since_custom_time` field will be omitted from the resulting object.\n  - `days_since_noncurrent_time` (`number`): Number of days elapsed since the noncurrent timestamp of an object. This\n\t\t\t\t\t\t\t\t\t\tcondition is relevant only for versioned objects. When `null`, the `days_since_noncurrent_time` field will be omitted from the resulting object.\n  - `matches_prefix` (`list`): One or more matching name prefixes to satisfy this condition. When `null`, the `matches_prefix` field will be omitted from the resulting object.\n  - `matches_storage_class` (`list`): Storage Class of objects to satisfy this condition. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, STANDARD, DURABLE_REDUCED_AVAILABILITY. When `null`, the `matches_storage_class` field will be omitted from the resulting object.\n  - `matches_suffix` (`list`): One or more matching name suffixes to satisfy this condition. When `null`, the `matches_suffix` field will be omitted from the resulting object.\n  - `noncurrent_time_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `noncurrent_time_before` field will be omitted from the resulting object.\n  - `num_newer_versions` (`number`): Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition. When `null`, the `num_newer_versions` field will be omitted from the resulting object.\n  - `with_state` (`string`): Match to live and/or archived objects. Unversioned buckets have only live objects. Supported values include: "LIVE", "ARCHIVED", "ANY". When `null`, the `with_state` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.storage_bucket.lifecycle_rule.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `age` (`number`): Minimum age of an object in days to satisfy this condition. When `null`, the `age` field will be omitted from the resulting object.\n  - `created_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `created_before` field will be omitted from the resulting object.\n  - `custom_time_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `custom_time_before` field will be omitted from the resulting object.\n  - `days_since_custom_time` (`number`): Number of days elapsed since the user-specified timestamp set on an object. When `null`, the `days_since_custom_time` field will be omitted from the resulting object.\n  - `days_since_noncurrent_time` (`number`): Number of days elapsed since the noncurrent timestamp of an object. This\n\t\t\t\t\t\t\t\t\t\tcondition is relevant only for versioned objects. When `null`, the `days_since_noncurrent_time` field will be omitted from the resulting object.\n  - `matches_prefix` (`list`): One or more matching name prefixes to satisfy this condition. When `null`, the `matches_prefix` field will be omitted from the resulting object.\n  - `matches_storage_class` (`list`): Storage Class of objects to satisfy this condition. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, STANDARD, DURABLE_REDUCED_AVAILABILITY. When `null`, the `matches_storage_class` field will be omitted from the resulting object.\n  - `matches_suffix` (`list`): One or more matching name suffixes to satisfy this condition. When `null`, the `matches_suffix` field will be omitted from the resulting object.\n  - `no_age` (`bool`): While set true, age value will be omitted.Required to set true when age is unset in the config file. When `null`, the `no_age` field will be omitted from the resulting object.\n  - `noncurrent_time_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `noncurrent_time_before` field will be omitted from the resulting object.\n  - `num_newer_versions` (`number`): Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition. When `null`, the `num_newer_versions` field will be omitted from the resulting object.\n  - `with_state` (`string`): Match to live and/or archived objects. Unversioned buckets have only live objects. Supported values include: "LIVE", "ARCHIVED", "ANY". When `null`, the `with_state` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
       new(
         age=null,
         created_before=null,
@@ -62,6 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         matches_prefix=null,
         matches_storage_class=null,
         matches_suffix=null,
+        no_age=null,
         noncurrent_time_before=null,
         num_newer_versions=null,
         with_state=null
@@ -74,6 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         matches_prefix: matches_prefix,
         matches_storage_class: matches_storage_class,
         matches_suffix: matches_suffix,
+        no_age: no_age,
         noncurrent_time_before: noncurrent_time_before,
         num_newer_versions: num_newer_versions,
         with_state: with_state,
@@ -98,7 +102,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       log_object_prefix: log_object_prefix,
     }),
   },
-  '#new':: d.fn(help="\n`google.storage_bucket.new` injects a new `google_storage_bucket` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket` using the reference:\n\n    $._ref.google_storage_bucket.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket\u0026#39;s autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket\u0026#39;s Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket\u0026#39;s custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket\u0026#39;s encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket\u0026#39;s Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket\u0026#39;s Access \u0026amp; Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket\u0026#39;s data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket\u0026#39;s Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.storage_bucket.new` injects a new `google_storage_bucket` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket` using the reference:\n\n    $._ref.google_storage_bucket.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `rpo` (`string`): Specifies the RPO setting of bucket. If set \u0026#39;ASYNC_TURBO\u0026#39;, The Turbo Replication will be enabled for the dual-region bucket. Value \u0026#39;DEFAULT\u0026#39; will set RPO setting to default. Turbo Replication is only for buckets in dual-regions.See the docs for more details. When `null`, the `rpo` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket\u0026#39;s autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket\u0026#39;s Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket\u0026#39;s custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket\u0026#39;s encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket\u0026#39;s Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket\u0026#39;s Access \u0026amp; Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket\u0026#39;s data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket\u0026#39;s Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -107,6 +111,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cors=null,
     custom_placement_config=null,
     default_event_based_hold=null,
+    enable_object_retention=null,
     encryption=null,
     force_destroy=null,
     labels=null,
@@ -116,6 +121,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     public_access_prevention=null,
     requester_pays=null,
     retention_policy=null,
+    rpo=null,
     storage_class=null,
     timeouts=null,
     uniform_bucket_level_access=null,
@@ -130,6 +136,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cors=cors,
       custom_placement_config=custom_placement_config,
       default_event_based_hold=default_event_based_hold,
+      enable_object_retention=enable_object_retention,
       encryption=encryption,
       force_destroy=force_destroy,
       labels=labels,
@@ -141,6 +148,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       public_access_prevention=public_access_prevention,
       requester_pays=requester_pays,
       retention_policy=retention_policy,
+      rpo=rpo,
       storage_class=storage_class,
       timeouts=timeouts,
       uniform_bucket_level_access=uniform_bucket_level_access,
@@ -149,7 +157,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.storage_bucket.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket`\nTerraform resource.\n\nUnlike [google.storage_bucket.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket's autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket's Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket's encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket's Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket's Access & Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket's data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket's Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.storage_bucket.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket`\nTerraform resource.\n\nUnlike [google.storage_bucket.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `rpo` (`string`): Specifies the RPO setting of bucket. If set 'ASYNC_TURBO', The Turbo Replication will be enabled for the dual-region bucket. Value 'DEFAULT' will set RPO setting to default. Turbo Replication is only for buckets in dual-regions.See the docs for more details. When `null`, the `rpo` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket's autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket's Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket's encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket's Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket's Access & Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket's data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket's Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -157,6 +165,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cors=null,
     custom_placement_config=null,
     default_event_based_hold=null,
+    enable_object_retention=null,
     encryption=null,
     force_destroy=null,
     labels=null,
@@ -166,6 +175,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     public_access_prevention=null,
     requester_pays=null,
     retention_policy=null,
+    rpo=null,
     storage_class=null,
     timeouts=null,
     uniform_bucket_level_access=null,
@@ -176,6 +186,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cors: cors,
     custom_placement_config: custom_placement_config,
     default_event_based_hold: default_event_based_hold,
+    enable_object_retention: enable_object_retention,
     encryption: encryption,
     force_destroy: force_destroy,
     labels: labels,
@@ -187,6 +198,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     public_access_prevention: public_access_prevention,
     requester_pays: requester_pays,
     retention_policy: retention_policy,
+    rpo: rpo,
     storage_class: storage_class,
     timeouts: timeouts,
     uniform_bucket_level_access: uniform_bucket_level_access,
@@ -303,6 +315,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEnableObjectRetention':: d.fn(help='`google.bool.withEnableObjectRetention` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_object_retention field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_object_retention` field.\n', args=[]),
+  withEnableObjectRetention(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket+: {
+        [resourceLabel]+: {
+          enable_object_retention: value,
+        },
+      },
+    },
+  },
   '#withEncryption':: d.fn(help='`google.list[obj].withEncryption` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the encryption field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEncryptionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `encryption` field.\n', args=[]),
   withEncryption(resourceLabel, value): {
     resource+: {
@@ -453,6 +475,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRpo':: d.fn(help='`google.string.withRpo` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the rpo field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `rpo` field.\n', args=[]),
+  withRpo(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket+: {
+        [resourceLabel]+: {
+          rpo: value,
+        },
+      },
+    },
+  },
   '#withStorageClass':: d.fn(help='`google.string.withStorageClass` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the storage_class field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `storage_class` field.\n', args=[]),
   withStorageClass(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/storage_bucket_object.libsonnet b/4.x/_gen/resources/storage_bucket_object.libsonnet
index 9c91ffeb..a61ecdd3 100644
--- a/4.x/_gen/resources/storage_bucket_object.libsonnet
+++ b/4.x/_gen/resources/storage_bucket_object.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       encryption_key: encryption_key,
     }),
   },
-  '#new':: d.fn(help="\n`google.storage_bucket_object.new` injects a new `google_storage_bucket_object` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket_object.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket_object` using the reference:\n\n    $._ref.google_storage_bucket_object.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket_object.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to \u0026#34;application/octet-stream\u0026#34; or \u0026#34;text/plain; charset=utf-8\u0026#34;. When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting resource block. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold\u0026#39;s release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata\u0026#39;s kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you\u0026#39;re interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket\u0026#39;s default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.storage_bucket_object.new` injects a new `google_storage_bucket_object` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket_object.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket_object` using the reference:\n\n    $._ref.google_storage_bucket_object.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket_object.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to \u0026#34;application/octet-stream\u0026#34; or \u0026#34;text/plain; charset=utf-8\u0026#34;. When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting resource block. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold\u0026#39;s release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata\u0026#39;s kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you\u0026#39;re interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket\u0026#39;s default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     bucket,
@@ -28,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     event_based_hold=null,
     kms_key_name=null,
     metadata=null,
+    retention=null,
     source=null,
     storage_class=null,
     temporary_hold=null,
@@ -50,6 +51,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name=kms_key_name,
       metadata=metadata,
       name=name,
+      retention=retention,
       source=source,
       storage_class=storage_class,
       temporary_hold=temporary_hold,
@@ -57,7 +59,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.storage_bucket_object.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket_object`\nTerraform resource.\n\nUnlike [google.storage_bucket_object.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to "application/octet-stream" or "text/plain; charset=utf-8". When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting object. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata's kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you're interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket_object` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.storage_bucket_object.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket_object`\nTerraform resource.\n\nUnlike [google.storage_bucket_object.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to "application/octet-stream" or "text/plain; charset=utf-8". When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting object. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata's kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you're interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket_object` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     bucket,
     name,
@@ -72,6 +74,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     event_based_hold=null,
     kms_key_name=null,
     metadata=null,
+    retention=null,
     source=null,
     storage_class=null,
     temporary_hold=null,
@@ -90,11 +93,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     kms_key_name: kms_key_name,
     metadata: metadata,
     name: name,
+    retention: retention,
     source: source,
     storage_class: storage_class,
     temporary_hold: temporary_hold,
     timeouts: timeouts,
   }),
+  retention:: {
+    '#new':: d.fn(help='\n`google.storage_bucket_object.retention.new` constructs a new object with attributes and blocks configured for the `retention`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): The object retention mode. Supported values include: "Unlocked", "Locked".\n  - `retain_until_time` (`string`): Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.\n\n**Returns**:\n  - An attribute object that represents the `retention` sub block.\n', args=[]),
+    new(
+      mode,
+      retain_until_time
+    ):: std.prune(a={
+      mode: mode,
+      retain_until_time: retain_until_time,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.storage_bucket_object.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -247,6 +261,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRetention':: d.fn(help='`google.list[obj].withRetention` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the retention field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withRetentionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `retention` field.\n', args=[]),
+  withRetention(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket_object+: {
+        [resourceLabel]+: {
+          retention: value,
+        },
+      },
+    },
+  },
+  '#withRetentionMixin':: d.fn(help='`google.list[obj].withRetentionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the retention field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withRetention](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `retention` field.\n', args=[]),
+  withRetentionMixin(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket_object+: {
+        [resourceLabel]+: {
+          retention+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withSource':: d.fn(help='`google.string.withSource` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the source field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `source` field.\n', args=[]),
   withSource(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/storage_transfer_job.libsonnet b/4.x/_gen/resources/storage_transfer_job.libsonnet
index a80d8605..06e9a7d8 100644
--- a/4.x/_gen/resources/storage_transfer_job.libsonnet
+++ b/4.x/_gen/resources/storage_transfer_job.libsonnet
@@ -2,10 +2,24 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='storage_transfer_job', url='', help='`storage_transfer_job` represents the `google_storage_transfer_job` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.storage_transfer_job.new` injects a new `google_storage_transfer_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_transfer_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_transfer_job` using the reference:\n\n    $._ref.google_storage_transfer_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_transfer_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  event_stream:: {
+    '#new':: d.fn(help='\n`google.storage_transfer_job.event_stream.new` constructs a new object with attributes and blocks configured for the `event_stream`\nTerraform sub block.\n\n\n\n**Args**:\n  - `event_stream_expiration_time` (`string`): Specifies the data and time at which Storage Transfer Service stops listening for events from this stream. After this time, any transfers in progress will complete, but no new transfers are initiated When `null`, the `event_stream_expiration_time` field will be omitted from the resulting object.\n  - `event_stream_start_time` (`string`): Specifies the date and time that Storage Transfer Service starts listening for events from this stream. If no start time is specified or start time is in the past, Storage Transfer Service starts listening immediately When `null`, the `event_stream_start_time` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies a unique name of the resource such as AWS SQS ARN in the form 'arn:aws:sqs:region:account_id:queue_name', or Pub/Sub subscription resource name in the form 'projects/{project}/subscriptions/{sub}'\n\n**Returns**:\n  - An attribute object that represents the `event_stream` sub block.\n', args=[]),
+    new(
+      name,
+      event_stream_expiration_time=null,
+      event_stream_start_time=null
+    ):: std.prune(a={
+      event_stream_expiration_time: event_stream_expiration_time,
+      event_stream_start_time: event_stream_start_time,
+      name: name,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.storage_transfer_job.new` injects a new `google_storage_transfer_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_transfer_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_transfer_job` using the reference:\n\n    $._ref.google_storage_transfer_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_transfer_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `name` (`string`): The name of the Transfer Job. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting resource block. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     description,
+    event_stream=null,
+    name=null,
     notification_config=null,
     project=null,
     schedule=null,
@@ -17,6 +31,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       description=description,
+      event_stream=event_stream,
+      name=name,
       notification_config=notification_config,
       project=project,
       schedule=schedule,
@@ -25,9 +41,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.storage_transfer_job.newAttrs` constructs a new object with attributes and blocks configured for the `storage_transfer_job`\nTerraform resource.\n\nUnlike [google.storage_transfer_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_transfer_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.storage_transfer_job.newAttrs` constructs a new object with attributes and blocks configured for the `storage_transfer_job`\nTerraform resource.\n\nUnlike [google.storage_transfer_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `name` (`string`): The name of the Transfer Job. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting object. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_transfer_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     description,
+    event_stream=null,
+    name=null,
     notification_config=null,
     project=null,
     schedule=null,
@@ -35,6 +53,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     transfer_spec=null
   ):: std.prune(a={
     description: description,
+    event_stream: event_stream,
+    name: name,
     notification_config: notification_config,
     project: project,
     schedule: schedule,
@@ -265,6 +285,36 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEventStream':: d.fn(help='`google.list[obj].withEventStream` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_stream field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEventStreamMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_stream` field.\n', args=[]),
+  withEventStream(resourceLabel, value): {
+    resource+: {
+      google_storage_transfer_job+: {
+        [resourceLabel]+: {
+          event_stream: value,
+        },
+      },
+    },
+  },
+  '#withEventStreamMixin':: d.fn(help='`google.list[obj].withEventStreamMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_stream field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEventStream](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_stream` field.\n', args=[]),
+  withEventStreamMixin(resourceLabel, value): {
+    resource+: {
+      google_storage_transfer_job+: {
+        [resourceLabel]+: {
+          event_stream+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_storage_transfer_job+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
   '#withNotificationConfig':: d.fn(help='`google.list[obj].withNotificationConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the notification_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNotificationConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `notification_config` field.\n', args=[]),
   withNotificationConfig(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/tpu_node.libsonnet b/4.x/_gen/resources/tpu_node.libsonnet
index e2e234d2..00463195 100644
--- a/4.x/_gen/resources/tpu_node.libsonnet
+++ b/4.x/_gen/resources/tpu_node.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='tpu_node', url='', help='`tpu_node` represents the `google_tpu_node` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.tpu_node.new` injects a new `google_tpu_node` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.tpu_node.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.tpu_node` using the reference:\n\n    $._ref.google_tpu_node.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_tpu_node.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user\u0026#39;s provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, \u0026#34;default\u0026#34; will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.tpu_node.new` injects a new `google_tpu_node` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.tpu_node.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.tpu_node` using the reference:\n\n    $._ref.google_tpu_node.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_tpu_node.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user\u0026#39;s provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, \u0026#34;default\u0026#34; will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     accelerator_type,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.tpu_node.newAttrs` constructs a new object with attributes and blocks configured for the `tpu_node`\nTerraform resource.\n\nUnlike [google.tpu_node.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user's provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, "default" will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `tpu_node` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.tpu_node.newAttrs` constructs a new object with attributes and blocks configured for the `tpu_node`\nTerraform resource.\n\nUnlike [google.tpu_node.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user's provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, "default" will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `tpu_node` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     accelerator_type,
     name,
diff --git a/4.x/_gen/resources/vertex_ai_dataset.libsonnet b/4.x/_gen/resources/vertex_ai_dataset.libsonnet
index ee64c5ff..054022b1 100644
--- a/4.x/_gen/resources/vertex_ai_dataset.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_dataset.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_dataset.new` injects a new `google_vertex_ai_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_dataset` using the reference:\n\n    $._ref.google_vertex_ai_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_dataset.new` injects a new `google_vertex_ai_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_dataset` using the reference:\n\n    $._ref.google_vertex_ai_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_dataset`\nTerraform resource.\n\nUnlike [google.vertex_ai_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_dataset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_dataset`\nTerraform resource.\n\nUnlike [google.vertex_ai_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_dataset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     metadata_schema_uri,
diff --git a/4.x/_gen/resources/vertex_ai_endpoint.libsonnet b/4.x/_gen/resources/vertex_ai_endpoint.libsonnet
index e11209a8..2bbaeb11 100644
--- a/4.x/_gen/resources/vertex_ai_endpoint.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_endpoint.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_endpoint.new` injects a new `google_vertex_ai_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;. Where \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_endpoint.new` injects a new `google_vertex_ai_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;. Where \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -41,7 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_endpoint` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_endpoint` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     location,
diff --git a/4.x/_gen/resources/vertex_ai_feature_group.libsonnet b/4.x/_gen/resources/vertex_ai_feature_group.libsonnet
new file mode 100644
index 00000000..c04bc0fa
--- /dev/null
+++ b/4.x/_gen/resources/vertex_ai_feature_group.libsonnet
@@ -0,0 +1,168 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vertex_ai_feature_group', url='', help='`vertex_ai_feature_group` represents the `google_vertex_ai_feature_group` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  big_query:: {
+    big_query_source:: {
+      '#new':: d.fn(help='\n`google.vertex_ai_feature_group.big_query.big_query_source.new` constructs a new object with attributes and blocks configured for the `big_query_source`\nTerraform sub block.\n\n\n\n**Args**:\n  - `input_uri` (`string`): BigQuery URI to a table, up to 2000 characters long. For example: 'bq://projectId.bqDatasetId.bqTableId.'\n\n**Returns**:\n  - An attribute object that represents the `big_query_source` sub block.\n', args=[]),
+      new(
+        input_uri
+      ):: std.prune(a={
+        input_uri: input_uri,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_group.big_query.new` constructs a new object with attributes and blocks configured for the `big_query`\nTerraform sub block.\n\n\n\n**Args**:\n  - `entity_id_columns` (`list`): Columns to construct entityId / row keys. Currently only supports 1 entity_id_column. If not provided defaults to entityId. When `null`, the `entity_id_columns` field will be omitted from the resulting object.\n  - `big_query_source` (`list[obj]`): The BigQuery source URI that points to either a BigQuery Table or View. When `null`, the `big_query_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.big_query.big_query_source.new](#fn-big_querybig_query_sourcenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `big_query` sub block.\n', args=[]),
+    new(
+      big_query_source=null,
+      entity_id_columns=null
+    ):: std.prune(a={
+      big_query_source: big_query_source,
+      entity_id_columns: entity_id_columns,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.vertex_ai_feature_group.new` injects a new `google_vertex_ai_feature_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_feature_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_feature_group` using the reference:\n\n    $._ref.google_vertex_ai_feature_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_feature_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the Feature Group. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of feature group. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `big_query` (`list[obj]`): Indicates that features for this group come from BigQuery Table/View. By default treats the source as a sparse time series source, which is required to have an entityId and a feature_timestamp column in the source. When `null`, the `big_query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.big_query.new](#fn-big_querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    big_query=null,
+    description=null,
+    labels=null,
+    name=null,
+    project=null,
+    region=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vertex_ai_feature_group',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      big_query=big_query,
+      description=description,
+      labels=labels,
+      name=name,
+      project=project,
+      region=region,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_feature_group.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_group`\nTerraform resource.\n\nUnlike [google.vertex_ai_feature_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the Feature Group. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of feature group. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `big_query` (`list[obj]`): Indicates that features for this group come from BigQuery Table/View. By default treats the source as a sparse time series source, which is required to have an entityId and a feature_timestamp column in the source. When `null`, the `big_query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.big_query.new](#fn-big_querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_group` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    big_query=null,
+    description=null,
+    labels=null,
+    name=null,
+    project=null,
+    region=null,
+    timeouts=null
+  ):: std.prune(a={
+    big_query: big_query,
+    description: description,
+    labels: labels,
+    name: name,
+    project: project,
+    region: region,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_group.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withBigQuery':: d.fn(help='`google.list[obj].withBigQuery` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the big_query field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBigQueryMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `big_query` field.\n', args=[]),
+  withBigQuery(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          big_query: value,
+        },
+      },
+    },
+  },
+  '#withBigQueryMixin':: d.fn(help='`google.list[obj].withBigQueryMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the big_query field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBigQuery](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `big_query` field.\n', args=[]),
+  withBigQueryMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          big_query+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vertex_ai_feature_group_feature.libsonnet b/4.x/_gen/resources/vertex_ai_feature_group_feature.libsonnet
new file mode 100644
index 00000000..a37d6fdf
--- /dev/null
+++ b/4.x/_gen/resources/vertex_ai_feature_group_feature.libsonnet
@@ -0,0 +1,154 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vertex_ai_feature_group_feature', url='', help='`vertex_ai_feature_group_feature` represents the `google_vertex_ai_feature_group_feature` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.vertex_ai_feature_group_feature.new` injects a new `google_vertex_ai_feature_group_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_feature_group_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_feature_group_feature` using the reference:\n\n    $._ref.google_vertex_ai_feature_group_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_feature_group_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.\n  - `feature_group` (`string`): The name of the Feature Group.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the Feature Group Feature.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource. It should be the same as the feature group\u0026#39;s region.\n  - `version_column_name` (`string`): The name of the BigQuery Table/View column hosting data for this version. If no value is provided, will use featureId. When `null`, the `version_column_name` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    feature_group,
+    name,
+    region,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    version_column_name=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vertex_ai_feature_group_feature',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      feature_group=feature_group,
+      labels=labels,
+      name=name,
+      project=project,
+      region=region,
+      timeouts=timeouts,
+      version_column_name=version_column_name
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_feature_group_feature.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_group_feature`\nTerraform resource.\n\nUnlike [google.vertex_ai_feature_group_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.\n  - `feature_group` (`string`): The name of the Feature Group.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the Feature Group Feature.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource. It should be the same as the feature group's region.\n  - `version_column_name` (`string`): The name of the BigQuery Table/View column hosting data for this version. If no value is provided, will use featureId. When `null`, the `version_column_name` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_group_feature` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    feature_group,
+    name,
+    region,
+    description=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    version_column_name=null
+  ):: std.prune(a={
+    description: description,
+    feature_group: feature_group,
+    labels: labels,
+    name: name,
+    project: project,
+    region: region,
+    timeouts: timeouts,
+    version_column_name: version_column_name,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_group_feature.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withFeatureGroup':: d.fn(help='`google.string.withFeatureGroup` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the feature_group field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `feature_group` field.\n', args=[]),
+  withFeatureGroup(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          feature_group: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVersionColumnName':: d.fn(help='`google.string.withVersionColumnName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the version_column_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `version_column_name` field.\n', args=[]),
+  withVersionColumnName(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_group_feature+: {
+        [resourceLabel]+: {
+          version_column_name: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vertex_ai_feature_online_store.libsonnet b/4.x/_gen/resources/vertex_ai_feature_online_store.libsonnet
new file mode 100644
index 00000000..9014733f
--- /dev/null
+++ b/4.x/_gen/resources/vertex_ai_feature_online_store.libsonnet
@@ -0,0 +1,170 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vertex_ai_feature_online_store', url='', help='`vertex_ai_feature_online_store` represents the `google_vertex_ai_feature_online_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  bigtable:: {
+    auto_scaling:: {
+      '#new':: d.fn(help='\n`google.vertex_ai_feature_online_store.bigtable.auto_scaling.new` constructs a new object with attributes and blocks configured for the `auto_scaling`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu_utilization_target` (`number`): A percentage of the cluster's CPU capacity. Can be from 10% to 80%. When a cluster's CPU utilization exceeds the target that you have set, Bigtable immediately adds nodes to the cluster. When CPU utilization is substantially lower than the target, Bigtable removes nodes. If not set will default to 50%. When `null`, the `cpu_utilization_target` field will be omitted from the resulting object.\n  - `max_node_count` (`number`): The maximum number of nodes to scale up to. Must be greater than or equal to minNodeCount, and less than or equal to 10 times of 'minNodeCount'.\n  - `min_node_count` (`number`): The minimum number of nodes to scale down to. Must be greater than or equal to 1.\n\n**Returns**:\n  - An attribute object that represents the `auto_scaling` sub block.\n', args=[]),
+      new(
+        max_node_count,
+        min_node_count,
+        cpu_utilization_target=null
+      ):: std.prune(a={
+        cpu_utilization_target: cpu_utilization_target,
+        max_node_count: max_node_count,
+        min_node_count: min_node_count,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_online_store.bigtable.new` constructs a new object with attributes and blocks configured for the `bigtable`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_scaling` (`list[obj]`): Autoscaling config applied to Bigtable Instance. When `null`, the `auto_scaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.bigtable.auto_scaling.new](#fn-bigtableauto_scalingnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `bigtable` sub block.\n', args=[]),
+    new(
+      auto_scaling=null
+    ):: std.prune(a={
+      auto_scaling: auto_scaling,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.vertex_ai_feature_online_store.new` injects a new `google_vertex_ai_feature_online_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_feature_online_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_feature_online_store` using the reference:\n\n    $._ref.google_vertex_ai_feature_online_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_feature_online_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_destroy` (`bool`): If set to true, any FeatureViews and Features for this FeatureOnlineStore will also be deleted. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your feature online stores.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the Feature Online Store. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of feature online store. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `bigtable` (`list[obj]`): Settings for Cloud Bigtable instance that will be created to serve featureValues for all FeatureViews under this FeatureOnlineStore. When `null`, the `bigtable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.bigtable.new](#fn-bigtablenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    bigtable=null,
+    force_destroy=null,
+    labels=null,
+    project=null,
+    region=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vertex_ai_feature_online_store',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      bigtable=bigtable,
+      force_destroy=force_destroy,
+      labels=labels,
+      name=name,
+      project=project,
+      region=region,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_feature_online_store.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_online_store`\nTerraform resource.\n\nUnlike [google.vertex_ai_feature_online_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_destroy` (`bool`): If set to true, any FeatureViews and Features for this FeatureOnlineStore will also be deleted. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your feature online stores.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the Feature Online Store. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of feature online store. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `bigtable` (`list[obj]`): Settings for Cloud Bigtable instance that will be created to serve featureValues for all FeatureViews under this FeatureOnlineStore. When `null`, the `bigtable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.bigtable.new](#fn-bigtablenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_online_store` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    bigtable=null,
+    force_destroy=null,
+    labels=null,
+    project=null,
+    region=null,
+    timeouts=null
+  ):: std.prune(a={
+    bigtable: bigtable,
+    force_destroy: force_destroy,
+    labels: labels,
+    name: name,
+    project: project,
+    region: region,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_online_store.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withBigtable':: d.fn(help='`google.list[obj].withBigtable` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the bigtable field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBigtableMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `bigtable` field.\n', args=[]),
+  withBigtable(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          bigtable: value,
+        },
+      },
+    },
+  },
+  '#withBigtableMixin':: d.fn(help='`google.list[obj].withBigtableMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the bigtable field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBigtable](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `bigtable` field.\n', args=[]),
+  withBigtableMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          bigtable+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withForceDestroy':: d.fn(help='`google.bool.withForceDestroy` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the force_destroy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `force_destroy` field.\n', args=[]),
+  withForceDestroy(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          force_destroy: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vertex_ai_feature_online_store_featureview.libsonnet b/4.x/_gen/resources/vertex_ai_feature_online_store_featureview.libsonnet
new file mode 100644
index 00000000..ce1ab49d
--- /dev/null
+++ b/4.x/_gen/resources/vertex_ai_feature_online_store_featureview.libsonnet
@@ -0,0 +1,192 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vertex_ai_feature_online_store_featureview', url='', help='`vertex_ai_feature_online_store_featureview` represents the `google_vertex_ai_feature_online_store_featureview` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  big_query_source:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_online_store_featureview.big_query_source.new` constructs a new object with attributes and blocks configured for the `big_query_source`\nTerraform sub block.\n\n\n\n**Args**:\n  - `entity_id_columns` (`list`): Columns to construct entityId / row keys. Start by supporting 1 only.\n  - `uri` (`string`): The BigQuery view URI that will be materialized on each sync trigger based on FeatureView.SyncConfig.\n\n**Returns**:\n  - An attribute object that represents the `big_query_source` sub block.\n', args=[]),
+    new(
+      entity_id_columns,
+      uri
+    ):: std.prune(a={
+      entity_id_columns: entity_id_columns,
+      uri: uri,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.vertex_ai_feature_online_store_featureview.new` injects a new `google_vertex_ai_feature_online_store_featureview` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_feature_online_store_featureview.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_feature_online_store_featureview` using the reference:\n\n    $._ref.google_vertex_ai_feature_online_store_featureview.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_feature_online_store_featureview.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `feature_online_store` (`string`): The name of the FeatureOnlineStore to use for the featureview.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this FeatureView.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the FeatureView. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource. It should be the same as the featureonlinestore region.\n  - `big_query_source` (`list[obj]`): Configures how data is supposed to be extracted from a BigQuery source to be loaded onto the FeatureOnlineStore. When `null`, the `big_query_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.big_query_source.new](#fn-big_query_sourcenew) constructor.\n  - `sync_config` (`list[obj]`): Configures when data is to be synced/updated for this FeatureView. At the end of the sync the latest featureValues for each entityId of this FeatureView are made ready for online serving. When `null`, the `sync_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.sync_config.new](#fn-sync_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    feature_online_store,
+    region,
+    big_query_source=null,
+    labels=null,
+    name=null,
+    project=null,
+    sync_config=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vertex_ai_feature_online_store_featureview',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      big_query_source=big_query_source,
+      feature_online_store=feature_online_store,
+      labels=labels,
+      name=name,
+      project=project,
+      region=region,
+      sync_config=sync_config,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_feature_online_store_featureview.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_online_store_featureview`\nTerraform resource.\n\nUnlike [google.vertex_ai_feature_online_store_featureview.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `feature_online_store` (`string`): The name of the FeatureOnlineStore to use for the featureview.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this FeatureView.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the FeatureView. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource. It should be the same as the featureonlinestore region.\n  - `big_query_source` (`list[obj]`): Configures how data is supposed to be extracted from a BigQuery source to be loaded onto the FeatureOnlineStore. When `null`, the `big_query_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.big_query_source.new](#fn-big_query_sourcenew) constructor.\n  - `sync_config` (`list[obj]`): Configures when data is to be synced/updated for this FeatureView. At the end of the sync the latest featureValues for each entityId of this FeatureView are made ready for online serving. When `null`, the `sync_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.sync_config.new](#fn-sync_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_online_store_featureview` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    feature_online_store,
+    region,
+    big_query_source=null,
+    labels=null,
+    name=null,
+    project=null,
+    sync_config=null,
+    timeouts=null
+  ):: std.prune(a={
+    big_query_source: big_query_source,
+    feature_online_store: feature_online_store,
+    labels: labels,
+    name: name,
+    project: project,
+    region: region,
+    sync_config: sync_config,
+    timeouts: timeouts,
+  }),
+  sync_config:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_online_store_featureview.sync_config.new` constructs a new object with attributes and blocks configured for the `sync_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cron` (`string`): Cron schedule (https://en.wikipedia.org/wiki/Cron) to launch scheduled runs.\nTo explicitly set a timezone to the cron tab, apply a prefix in the cron tab: "CRON_TZ=${IANA_TIME_ZONE}" or "TZ=${IANA_TIME_ZONE}". When `null`, the `cron` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sync_config` sub block.\n', args=[]),
+    new(
+      cron=null
+    ):: std.prune(a={
+      cron: cron,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_feature_online_store_featureview.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withBigQuerySource':: d.fn(help='`google.list[obj].withBigQuerySource` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the big_query_source field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBigQuerySourceMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `big_query_source` field.\n', args=[]),
+  withBigQuerySource(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          big_query_source: value,
+        },
+      },
+    },
+  },
+  '#withBigQuerySourceMixin':: d.fn(help='`google.list[obj].withBigQuerySourceMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the big_query_source field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBigQuerySource](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `big_query_source` field.\n', args=[]),
+  withBigQuerySourceMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          big_query_source+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withFeatureOnlineStore':: d.fn(help='`google.string.withFeatureOnlineStore` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the feature_online_store field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `feature_online_store` field.\n', args=[]),
+  withFeatureOnlineStore(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          feature_online_store: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withSyncConfig':: d.fn(help='`google.list[obj].withSyncConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the sync_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSyncConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `sync_config` field.\n', args=[]),
+  withSyncConfig(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          sync_config: value,
+        },
+      },
+    },
+  },
+  '#withSyncConfigMixin':: d.fn(help='`google.list[obj].withSyncConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the sync_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSyncConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `sync_config` field.\n', args=[]),
+  withSyncConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          sync_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_feature_online_store_featureview+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vertex_ai_featurestore.libsonnet b/4.x/_gen/resources/vertex_ai_featurestore.libsonnet
index e2d40614..ee1c0ab7 100644
--- a/4.x/_gen/resources/vertex_ai_featurestore.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_featurestore.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_featurestore.new` injects a new `google_vertex_ai_featurestore` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore` using the reference:\n\n    $._ref.google_vertex_ai_featurestore.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_featurestore.new` injects a new `google_vertex_ai_featurestore` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore` using the reference:\n\n    $._ref.google_vertex_ai_featurestore.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     encryption_spec=null,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     encryption_spec=null,
     force_destroy=null,
diff --git a/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet b/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet
index 34fb0412..8456874a 100644
--- a/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet
@@ -54,7 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype.new` injects a new `google_vertex_ai_featurestore_entitytype` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype.new` injects a new `google_vertex_ai_featurestore_entitytype` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     featurestore,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     featurestore,
     description=null,
diff --git a/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet b/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet
index b3c52eac..659610c6 100644
--- a/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='vertex_ai_featurestore_entitytype_feature', url='', help='`vertex_ai_featurestore_entitytype_feature` represents the `google_vertex_ai_featurestore_entitytype_feature` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype_feature.new` injects a new `google_vertex_ai_featurestore_entitytype_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype_feature` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype_feature.new` injects a new `google_vertex_ai_featurestore_entitytype_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype_feature` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     entitytype,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype_feature.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype_feature`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype_feature` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype_feature.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype_feature`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype_feature` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     entitytype,
     value_type,
diff --git a/4.x/_gen/resources/vertex_ai_index.libsonnet b/4.x/_gen/resources/vertex_ai_index.libsonnet
index f3c83a5a..43cd73c5 100644
--- a/4.x/_gen/resources/vertex_ai_index.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_index.libsonnet
@@ -47,10 +47,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         shard_size: shard_size,
       }),
     },
-    '#new':: d.fn(help='\n`google.vertex_ai_index.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `contents_delta_uri` (`string`): Allows inserting, updating  or deleting the contents of the Matching Engine Index.\nThe string must be a valid Cloud Storage directory path. If this\nfield is set when calling IndexService.UpdateIndex, then no other\nIndex field can be also updated as part of the same call.\nThe expected structure and format of the files this URI points to is\ndescribed at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format When `null`, the `contents_delta_uri` field will be omitted from the resulting object.\n  - `is_complete_overwrite` (`bool`): If this field is set together with contentsDeltaUri when calling IndexService.UpdateIndex,\nthen existing content of the Index will be replaced by the data from the contentsDeltaUri. When `null`, the `is_complete_overwrite` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The configuration of the Matching Engine Index. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.config.new](#fn-metadataconfignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.vertex_ai_index.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `contents_delta_uri` (`string`): Allows inserting, updating  or deleting the contents of the Matching Engine Index.\nThe string must be a valid Cloud Storage directory path. If this\nfield is set when calling IndexService.UpdateIndex, then no other\nIndex field can be also updated as part of the same call.\nThe expected structure and format of the files this URI points to is\ndescribed at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format\n  - `is_complete_overwrite` (`bool`): If this field is set together with contentsDeltaUri when calling IndexService.UpdateIndex,\nthen existing content of the Index will be replaced by the data from the contentsDeltaUri. When `null`, the `is_complete_overwrite` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The configuration of the Matching Engine Index. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.config.new](#fn-metadataconfignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
     new(
+      contents_delta_uri,
       config=null,
-      contents_delta_uri=null,
       is_complete_overwrite=null
     ):: std.prune(a={
       config: config,
@@ -58,7 +58,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       is_complete_overwrite: is_complete_overwrite,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_index.new` injects a new `google_vertex_ai_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index` using the reference:\n\n    $._ref.google_vertex_ai_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_index.new` injects a new `google_vertex_ai_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index` using the reference:\n\n    $._ref.google_vertex_ai_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -85,7 +85,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index`\nTerraform resource.\n\nUnlike [google.vertex_ai_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index`\nTerraform resource.\n\nUnlike [google.vertex_ai_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
diff --git a/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet b/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet
index 7fd896a1..e7c73c8f 100644
--- a/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet
@@ -2,13 +2,14 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='vertex_ai_index_endpoint', url='', help='`vertex_ai_index_endpoint` represents the `google_vertex_ai_index_endpoint` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.vertex_ai_index_endpoint.new` injects a new `google_vertex_ai_index_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_index_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;.\nWhere \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_index_endpoint.new` injects a new `google_vertex_ai_index_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_index_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;.\nWhere \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `private_service_connect_config` (`list[obj]`): Optional. Configuration for private service connect. \u0026#39;network\u0026#39; and \u0026#39;privateServiceConnectConfig\u0026#39; are mutually exclusive. When `null`, the `private_service_connect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.private_service_connect_config.new](#fn-private_service_connect_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
     description=null,
     labels=null,
     network=null,
+    private_service_connect_config=null,
     project=null,
     public_endpoint_enabled=null,
     region=null,
@@ -22,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       display_name=display_name,
       labels=labels,
       network=network,
+      private_service_connect_config=private_service_connect_config,
       project=project,
       public_endpoint_enabled=public_endpoint_enabled,
       region=region,
@@ -29,12 +31,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_index_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.\nWhere '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index_endpoint` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_index_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.\nWhere '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `private_service_connect_config` (`list[obj]`): Optional. Configuration for private service connect. 'network' and 'privateServiceConnectConfig' are mutually exclusive. When `null`, the `private_service_connect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.private_service_connect_config.new](#fn-private_service_connect_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index_endpoint` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
     labels=null,
     network=null,
+    private_service_connect_config=null,
     project=null,
     public_endpoint_enabled=null,
     region=null,
@@ -44,11 +47,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name: display_name,
     labels: labels,
     network: network,
+    private_service_connect_config: private_service_connect_config,
     project: project,
     public_endpoint_enabled: public_endpoint_enabled,
     region: region,
     timeouts: timeouts,
   }),
+  private_service_connect_config:: {
+    '#new':: d.fn(help='\n`google.vertex_ai_index_endpoint.private_service_connect_config.new` constructs a new object with attributes and blocks configured for the `private_service_connect_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_private_service_connect` (`bool`): If set to true, the IndexEndpoint is created without private service access.\n  - `project_allowlist` (`list`): A list of Projects from which the forwarding rule will target the service attachment. When `null`, the `project_allowlist` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `private_service_connect_config` sub block.\n', args=[]),
+    new(
+      enable_private_service_connect,
+      project_allowlist=null
+    ):: std.prune(a={
+      enable_private_service_connect: enable_private_service_connect,
+      project_allowlist: project_allowlist,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.vertex_ai_index_endpoint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -101,6 +115,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPrivateServiceConnectConfig':: d.fn(help='`google.list[obj].withPrivateServiceConnectConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the private_service_connect_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPrivateServiceConnectConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `private_service_connect_config` field.\n', args=[]),
+  withPrivateServiceConnectConfig(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_index_endpoint+: {
+        [resourceLabel]+: {
+          private_service_connect_config: value,
+        },
+      },
+    },
+  },
+  '#withPrivateServiceConnectConfigMixin':: d.fn(help='`google.list[obj].withPrivateServiceConnectConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the private_service_connect_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPrivateServiceConnectConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `private_service_connect_config` field.\n', args=[]),
+  withPrivateServiceConnectConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_vertex_ai_index_endpoint+: {
+        [resourceLabel]+: {
+          private_service_connect_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
   withProject(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet b/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet
index d33ddb68..b6c42701 100644
--- a/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_tensorboard.new` injects a new `google_vertex_ai_tensorboard` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_tensorboard.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_tensorboard` using the reference:\n\n    $._ref.google_vertex_ai_tensorboard.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_tensorboard.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_tensorboard.new` injects a new `google_vertex_ai_tensorboard` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_tensorboard.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_tensorboard` using the reference:\n\n    $._ref.google_vertex_ai_tensorboard.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_tensorboard.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_tensorboard.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_tensorboard`\nTerraform resource.\n\nUnlike [google.vertex_ai_tensorboard.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_tensorboard` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_tensorboard.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_tensorboard`\nTerraform resource.\n\nUnlike [google.vertex_ai_tensorboard.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_tensorboard` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
diff --git a/4.x/_gen/resources/vmwareengine_cluster.libsonnet b/4.x/_gen/resources/vmwareengine_cluster.libsonnet
new file mode 100644
index 00000000..0722ef59
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_cluster.libsonnet
@@ -0,0 +1,120 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_cluster', url='', help='`vmwareengine_cluster` represents the `google_vmwareengine_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.vmwareengine_cluster.new` injects a new `google_vmwareengine_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_cluster` using the reference:\n\n    $._ref.google_vmwareengine_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `name` (`string`): The ID of the Cluster.\n  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n  - `node_type_configs` (`list[obj]`): The map of cluster node types in this cluster,\nwhere the key is canonical identifier of the node type (corresponds to the NodeType). When `null`, the `node_type_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.node_type_configs.new](#fn-node_type_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    parent,
+    node_type_configs=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      name=name,
+      node_type_configs=node_type_configs,
+      parent=parent,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_cluster`\nTerraform resource.\n\nUnlike [google.vmwareengine_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): The ID of the Cluster.\n  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n  - `node_type_configs` (`list[obj]`): The map of cluster node types in this cluster,\nwhere the key is canonical identifier of the node type (corresponds to the NodeType). When `null`, the `node_type_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.node_type_configs.new](#fn-node_type_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    parent,
+    node_type_configs=null,
+    timeouts=null
+  ):: std.prune(a={
+    name: name,
+    node_type_configs: node_type_configs,
+    parent: parent,
+    timeouts: timeouts,
+  }),
+  node_type_configs:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_cluster.node_type_configs.new` constructs a new object with attributes and blocks configured for the `node_type_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `custom_core_count` (`number`): Customized number of cores available to each node of the type.\nThis number must always be one of 'nodeType.availableCustomCoreCounts'.\nIf zero is provided max value from 'nodeType.availableCustomCoreCounts' will be used.\nOnce the customer is created then corecount cannot be changed. When `null`, the `custom_core_count` field will be omitted from the resulting object.\n  - `node_count` (`number`): The number of nodes of this type in the cluster.\n  - `node_type_id` (`string`): Set the `node_type_id` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_type_configs` sub block.\n', args=[]),
+    new(
+      node_count,
+      node_type_id,
+      custom_core_count=null
+    ):: std.prune(a={
+      custom_core_count: custom_core_count,
+      node_count: node_count,
+      node_type_id: node_type_id,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodeTypeConfigs':: d.fn(help='`google.list[obj].withNodeTypeConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_type_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeTypeConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_type_configs` field.\n', args=[]),
+  withNodeTypeConfigs(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_cluster+: {
+        [resourceLabel]+: {
+          node_type_configs: value,
+        },
+      },
+    },
+  },
+  '#withNodeTypeConfigsMixin':: d.fn(help='`google.list[obj].withNodeTypeConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_type_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeTypeConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_type_configs` field.\n', args=[]),
+  withNodeTypeConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_cluster+: {
+        [resourceLabel]+: {
+          node_type_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_cluster+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_external_access_rule.libsonnet b/4.x/_gen/resources/vmwareengine_external_access_rule.libsonnet
new file mode 100644
index 00000000..e69704b0
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_external_access_rule.libsonnet
@@ -0,0 +1,236 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_external_access_rule', url='', help='`vmwareengine_external_access_rule` represents the `google_vmwareengine_external_access_rule` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  destination_ip_ranges:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_external_access_rule.destination_ip_ranges.new` constructs a new object with attributes and blocks configured for the `destination_ip_ranges`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_address` (`string`): The name of an 'ExternalAddress' resource. When `null`, the `external_address` field will be omitted from the resulting object.\n  - `ip_address_range` (`string`): An IP address range in the CIDR format. When `null`, the `ip_address_range` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `destination_ip_ranges` sub block.\n', args=[]),
+    new(
+      external_address=null,
+      ip_address_range=null
+    ):: std.prune(a={
+      external_address: external_address,
+      ip_address_range: ip_address_range,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.vmwareengine_external_access_rule.new` injects a new `google_vmwareengine_external_access_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_external_access_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_external_access_rule` using the reference:\n\n    $._ref.google_vmwareengine_external_access_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_external_access_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `action` (`string`): The action that the external access rule performs. Possible values: [\u0026#34;ALLOW\u0026#34;, \u0026#34;DENY\u0026#34;]\n  - `description` (`string`): User-provided description for the external access rule. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination_ports` (`list`): A list of destination ports to which the external access rule applies.\n  - `ip_protocol` (`string`): The IP protocol to which the external access rule applies.\n  - `name` (`string`): The ID of the external access rule.\n  - `parent` (`string`): The resource name of the network policy.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy\n  - `priority` (`number`): External access rule priority, which determines the external access rule to use when multiple rules apply.\n  - `source_ports` (`list`): A list of source ports to which the external access rule applies.\n  - `destination_ip_ranges` (`list[obj]`): If destination ranges are specified, the external access rule applies only to\ntraffic that has a destination IP address in these ranges. When `null`, the `destination_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.destination_ip_ranges.new](#fn-destination_ip_rangesnew) constructor.\n  - `source_ip_ranges` (`list[obj]`): If source ranges are specified, the external access rule applies only to\ntraffic that has a source IP address in these ranges. When `null`, the `source_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.source_ip_ranges.new](#fn-source_ip_rangesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    action,
+    destination_ports,
+    ip_protocol,
+    name,
+    parent,
+    priority,
+    source_ports,
+    description=null,
+    destination_ip_ranges=null,
+    source_ip_ranges=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_external_access_rule',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      action=action,
+      description=description,
+      destination_ip_ranges=destination_ip_ranges,
+      destination_ports=destination_ports,
+      ip_protocol=ip_protocol,
+      name=name,
+      parent=parent,
+      priority=priority,
+      source_ip_ranges=source_ip_ranges,
+      source_ports=source_ports,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_external_access_rule.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_access_rule`\nTerraform resource.\n\nUnlike [google.vmwareengine_external_access_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `action` (`string`): The action that the external access rule performs. Possible values: ["ALLOW", "DENY"]\n  - `description` (`string`): User-provided description for the external access rule. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination_ports` (`list`): A list of destination ports to which the external access rule applies.\n  - `ip_protocol` (`string`): The IP protocol to which the external access rule applies.\n  - `name` (`string`): The ID of the external access rule.\n  - `parent` (`string`): The resource name of the network policy.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy\n  - `priority` (`number`): External access rule priority, which determines the external access rule to use when multiple rules apply.\n  - `source_ports` (`list`): A list of source ports to which the external access rule applies.\n  - `destination_ip_ranges` (`list[obj]`): If destination ranges are specified, the external access rule applies only to\ntraffic that has a destination IP address in these ranges. When `null`, the `destination_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.destination_ip_ranges.new](#fn-destination_ip_rangesnew) constructor.\n  - `source_ip_ranges` (`list[obj]`): If source ranges are specified, the external access rule applies only to\ntraffic that has a source IP address in these ranges. When `null`, the `source_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.source_ip_ranges.new](#fn-source_ip_rangesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_external_access_rule` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    action,
+    destination_ports,
+    ip_protocol,
+    name,
+    parent,
+    priority,
+    source_ports,
+    description=null,
+    destination_ip_ranges=null,
+    source_ip_ranges=null,
+    timeouts=null
+  ):: std.prune(a={
+    action: action,
+    description: description,
+    destination_ip_ranges: destination_ip_ranges,
+    destination_ports: destination_ports,
+    ip_protocol: ip_protocol,
+    name: name,
+    parent: parent,
+    priority: priority,
+    source_ip_ranges: source_ip_ranges,
+    source_ports: source_ports,
+    timeouts: timeouts,
+  }),
+  source_ip_ranges:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_external_access_rule.source_ip_ranges.new` constructs a new object with attributes and blocks configured for the `source_ip_ranges`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_address` (`string`): A single IP address. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_address_range` (`string`): An IP address range in the CIDR format. When `null`, the `ip_address_range` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `source_ip_ranges` sub block.\n', args=[]),
+    new(
+      ip_address=null,
+      ip_address_range=null
+    ):: std.prune(a={
+      ip_address: ip_address,
+      ip_address_range: ip_address_range,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_external_access_rule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAction':: d.fn(help='`google.string.withAction` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the action field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `action` field.\n', args=[]),
+  withAction(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          action: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDestinationIpRanges':: d.fn(help='`google.list[obj].withDestinationIpRanges` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the destination_ip_ranges field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDestinationIpRangesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `destination_ip_ranges` field.\n', args=[]),
+  withDestinationIpRanges(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          destination_ip_ranges: value,
+        },
+      },
+    },
+  },
+  '#withDestinationIpRangesMixin':: d.fn(help='`google.list[obj].withDestinationIpRangesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the destination_ip_ranges field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDestinationIpRanges](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `destination_ip_ranges` field.\n', args=[]),
+  withDestinationIpRangesMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          destination_ip_ranges+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDestinationPorts':: d.fn(help='`google.list.withDestinationPorts` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the destination_ports field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `destination_ports` field.\n', args=[]),
+  withDestinationPorts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          destination_ports: value,
+        },
+      },
+    },
+  },
+  '#withIpProtocol':: d.fn(help='`google.string.withIpProtocol` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the ip_protocol field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `ip_protocol` field.\n', args=[]),
+  withIpProtocol(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          ip_protocol: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withPriority':: d.fn(help='`google.number.withPriority` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the priority field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `priority` field.\n', args=[]),
+  withPriority(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          priority: value,
+        },
+      },
+    },
+  },
+  '#withSourceIpRanges':: d.fn(help='`google.list[obj].withSourceIpRanges` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the source_ip_ranges field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSourceIpRangesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `source_ip_ranges` field.\n', args=[]),
+  withSourceIpRanges(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          source_ip_ranges: value,
+        },
+      },
+    },
+  },
+  '#withSourceIpRangesMixin':: d.fn(help='`google.list[obj].withSourceIpRangesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the source_ip_ranges field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSourceIpRanges](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `source_ip_ranges` field.\n', args=[]),
+  withSourceIpRangesMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          source_ip_ranges+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withSourcePorts':: d.fn(help='`google.list.withSourcePorts` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the source_ports field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `source_ports` field.\n', args=[]),
+  withSourcePorts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          source_ports: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_access_rule+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_external_address.libsonnet b/4.x/_gen/resources/vmwareengine_external_address.libsonnet
new file mode 100644
index 00000000..2986e588
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_external_address.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_external_address', url='', help='`vmwareengine_external_address` represents the `google_vmwareengine_external_address` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.vmwareengine_external_address.new` injects a new `google_vmwareengine_external_address` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_external_address.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_external_address` using the reference:\n\n    $._ref.google_vmwareengine_external_address.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_external_address.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description for this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `internal_ip` (`string`): The internal IP address of a workload VM.\n  - `name` (`string`): The ID of the external IP Address.\n  - `parent` (`string`): The resource name of the private cloud to create a new external address in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    internal_ip,
+    name,
+    parent,
+    description=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_external_address',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      internal_ip=internal_ip,
+      name=name,
+      parent=parent,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_external_address.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_address`\nTerraform resource.\n\nUnlike [google.vmwareengine_external_address.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description for this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `internal_ip` (`string`): The internal IP address of a workload VM.\n  - `name` (`string`): The ID of the external IP Address.\n  - `parent` (`string`): The resource name of the private cloud to create a new external address in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_external_address` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    internal_ip,
+    name,
+    parent,
+    description=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    internal_ip: internal_ip,
+    name: name,
+    parent: parent,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_external_address.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_address+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withInternalIp':: d.fn(help='`google.string.withInternalIp` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the internal_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `internal_ip` field.\n', args=[]),
+  withInternalIp(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_address+: {
+        [resourceLabel]+: {
+          internal_ip: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_address+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_address+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_address+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_external_address+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_network.libsonnet b/4.x/_gen/resources/vmwareengine_network.libsonnet
new file mode 100644
index 00000000..e7cda262
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_network.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_network', url='', help='`vmwareengine_network` represents the `google_vmwareengine_network` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.vmwareengine_network.new` injects a new `google_vmwareengine_network` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_network.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_network` using the reference:\n\n    $._ref.google_vmwareengine_network.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_network.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description for this VMware Engine network. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the VMwareEngineNetwork should reside.\n  - `name` (`string`): The ID of the VMwareEngineNetwork.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): VMware Engine network type. Possible values: [\u0026#34;LEGACY\u0026#34;, \u0026#34;STANDARD\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    type,
+    description=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_network',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      location=location,
+      name=name,
+      project=project,
+      timeouts=timeouts,
+      type=type
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_network.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network`\nTerraform resource.\n\nUnlike [google.vmwareengine_network.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description for this VMware Engine network. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the VMwareEngineNetwork should reside.\n  - `name` (`string`): The ID of the VMwareEngineNetwork.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): VMware Engine network type. Possible values: ["LEGACY", "STANDARD"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_network` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    type,
+    description=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    location: location,
+    name: name,
+    project: project,
+    timeouts: timeouts,
+    type: type,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_network.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_network_peering.libsonnet b/4.x/_gen/resources/vmwareengine_network_peering.libsonnet
new file mode 100644
index 00000000..be0be7e2
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_network_peering.libsonnet
@@ -0,0 +1,196 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_network_peering', url='', help='`vmwareengine_network_peering` represents the `google_vmwareengine_network_peering` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.vmwareengine_network_peering.new` injects a new `google_vmwareengine_network_peering` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_network_peering.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_network_peering` using the reference:\n\n    $._ref.google_vmwareengine_network_peering.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_network_peering.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description for this network peering. When `null`, the `description` field will be omitted from the resulting object.\n  - `export_custom_routes` (`bool`): True if custom routes are exported to the peered network; false otherwise. When `null`, the `export_custom_routes` field will be omitted from the resulting object.\n  - `export_custom_routes_with_public_ip` (`bool`): True if all subnet routes with a public IP address range are exported; false otherwise. When `null`, the `export_custom_routes_with_public_ip` field will be omitted from the resulting object.\n  - `import_custom_routes` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes` field will be omitted from the resulting object.\n  - `import_custom_routes_with_public_ip` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes_with_public_ip` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the Network Peering.\n  - `peer_network` (`string`): The relative resource name of the network to peer with a standard VMware Engine network.\nThe provided network can be a consumer VPC network or another standard VMware Engine network.\n  - `peer_network_type` (`string`): The type of the network to peer with the VMware Engine network. Possible values: [\u0026#34;STANDARD\u0026#34;, \u0026#34;VMWARE_ENGINE_NETWORK\u0026#34;, \u0026#34;PRIVATE_SERVICES_ACCESS\u0026#34;, \u0026#34;NETAPP_CLOUD_VOLUMES\u0026#34;, \u0026#34;THIRD_PARTY_SERVICE\u0026#34;, \u0026#34;DELL_POWERSCALE\u0026#34;]\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:\nprojects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}\ncan either be a project number or a project ID.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_peering.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    peer_network,
+    peer_network_type,
+    vmware_engine_network,
+    description=null,
+    export_custom_routes=null,
+    export_custom_routes_with_public_ip=null,
+    import_custom_routes=null,
+    import_custom_routes_with_public_ip=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_network_peering',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      export_custom_routes=export_custom_routes,
+      export_custom_routes_with_public_ip=export_custom_routes_with_public_ip,
+      import_custom_routes=import_custom_routes,
+      import_custom_routes_with_public_ip=import_custom_routes_with_public_ip,
+      name=name,
+      peer_network=peer_network,
+      peer_network_type=peer_network_type,
+      project=project,
+      timeouts=timeouts,
+      vmware_engine_network=vmware_engine_network
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_network_peering.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_peering`\nTerraform resource.\n\nUnlike [google.vmwareengine_network_peering.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description for this network peering. When `null`, the `description` field will be omitted from the resulting object.\n  - `export_custom_routes` (`bool`): True if custom routes are exported to the peered network; false otherwise. When `null`, the `export_custom_routes` field will be omitted from the resulting object.\n  - `export_custom_routes_with_public_ip` (`bool`): True if all subnet routes with a public IP address range are exported; false otherwise. When `null`, the `export_custom_routes_with_public_ip` field will be omitted from the resulting object.\n  - `import_custom_routes` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes` field will be omitted from the resulting object.\n  - `import_custom_routes_with_public_ip` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes_with_public_ip` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the Network Peering.\n  - `peer_network` (`string`): The relative resource name of the network to peer with a standard VMware Engine network.\nThe provided network can be a consumer VPC network or another standard VMware Engine network.\n  - `peer_network_type` (`string`): The type of the network to peer with the VMware Engine network. Possible values: ["STANDARD", "VMWARE_ENGINE_NETWORK", "PRIVATE_SERVICES_ACCESS", "NETAPP_CLOUD_VOLUMES", "THIRD_PARTY_SERVICE", "DELL_POWERSCALE"]\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:\nprojects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}\ncan either be a project number or a project ID.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_peering.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_network_peering` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    peer_network,
+    peer_network_type,
+    vmware_engine_network,
+    description=null,
+    export_custom_routes=null,
+    export_custom_routes_with_public_ip=null,
+    import_custom_routes=null,
+    import_custom_routes_with_public_ip=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    export_custom_routes: export_custom_routes,
+    export_custom_routes_with_public_ip: export_custom_routes_with_public_ip,
+    import_custom_routes: import_custom_routes,
+    import_custom_routes_with_public_ip: import_custom_routes_with_public_ip,
+    name: name,
+    peer_network: peer_network,
+    peer_network_type: peer_network_type,
+    project: project,
+    timeouts: timeouts,
+    vmware_engine_network: vmware_engine_network,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_network_peering.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withExportCustomRoutes':: d.fn(help='`google.bool.withExportCustomRoutes` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the export_custom_routes field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `export_custom_routes` field.\n', args=[]),
+  withExportCustomRoutes(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          export_custom_routes: value,
+        },
+      },
+    },
+  },
+  '#withExportCustomRoutesWithPublicIp':: d.fn(help='`google.bool.withExportCustomRoutesWithPublicIp` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the export_custom_routes_with_public_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `export_custom_routes_with_public_ip` field.\n', args=[]),
+  withExportCustomRoutesWithPublicIp(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          export_custom_routes_with_public_ip: value,
+        },
+      },
+    },
+  },
+  '#withImportCustomRoutes':: d.fn(help='`google.bool.withImportCustomRoutes` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the import_custom_routes field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `import_custom_routes` field.\n', args=[]),
+  withImportCustomRoutes(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          import_custom_routes: value,
+        },
+      },
+    },
+  },
+  '#withImportCustomRoutesWithPublicIp':: d.fn(help='`google.bool.withImportCustomRoutesWithPublicIp` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the import_custom_routes_with_public_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `import_custom_routes_with_public_ip` field.\n', args=[]),
+  withImportCustomRoutesWithPublicIp(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          import_custom_routes_with_public_ip: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withPeerNetwork':: d.fn(help='`google.string.withPeerNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the peer_network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `peer_network` field.\n', args=[]),
+  withPeerNetwork(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          peer_network: value,
+        },
+      },
+    },
+  },
+  '#withPeerNetworkType':: d.fn(help='`google.string.withPeerNetworkType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the peer_network_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `peer_network_type` field.\n', args=[]),
+  withPeerNetworkType(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          peer_network_type: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVmwareEngineNetwork':: d.fn(help='`google.string.withVmwareEngineNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the vmware_engine_network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `vmware_engine_network` field.\n', args=[]),
+  withVmwareEngineNetwork(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_peering+: {
+        [resourceLabel]+: {
+          vmware_engine_network: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_network_policy.libsonnet b/4.x/_gen/resources/vmwareengine_network_policy.libsonnet
new file mode 100644
index 00000000..68d764ce
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_network_policy.libsonnet
@@ -0,0 +1,204 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_network_policy', url='', help='`vmwareengine_network_policy` represents the `google_vmwareengine_network_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  external_ip:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_network_policy.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): True if the service is enabled; false otherwise. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `external_ip` sub block.\n', args=[]),
+    new(
+      enabled=null
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
+  internet_access:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_network_policy.internet_access.new` constructs a new object with attributes and blocks configured for the `internet_access`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): True if the service is enabled; false otherwise. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `internet_access` sub block.\n', args=[]),
+    new(
+      enabled=null
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.vmwareengine_network_policy.new` injects a new `google_vmwareengine_network_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_network_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_network_policy` using the reference:\n\n    $._ref.google_vmwareengine_network_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_network_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description for this network policy. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_services_cidr` (`string`): IP address range in CIDR notation used to create internet access and external IP access.\nAn RFC 1918 CIDR block, with a \u0026#34;/26\u0026#34; prefix, is required. The range cannot overlap with any\nprefixes either in the consumer VPC network or in use by the private clouds attached to that VPC network.\n  - `location` (`string`): The resource name of the location (region) to create the new network policy in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-central1\n  - `name` (`string`): The ID of the Network Policy.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:\nprojects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}\ncan either be a project number or a project ID.\n  - `external_ip` (`list[obj]`): Network service that allows External IP addresses to be assigned to VMware workloads.\nThis service can only be enabled when internetAccess is also enabled. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.external_ip.new](#fn-external_ipnew) constructor.\n  - `internet_access` (`list[obj]`): Network service that allows VMware workloads to access the internet. When `null`, the `internet_access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.internet_access.new](#fn-internet_accessnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    edge_services_cidr,
+    location,
+    name,
+    vmware_engine_network,
+    description=null,
+    external_ip=null,
+    internet_access=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_network_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      edge_services_cidr=edge_services_cidr,
+      external_ip=external_ip,
+      internet_access=internet_access,
+      location=location,
+      name=name,
+      project=project,
+      timeouts=timeouts,
+      vmware_engine_network=vmware_engine_network
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_network_policy.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_policy`\nTerraform resource.\n\nUnlike [google.vmwareengine_network_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description for this network policy. When `null`, the `description` field will be omitted from the resulting object.\n  - `edge_services_cidr` (`string`): IP address range in CIDR notation used to create internet access and external IP access.\nAn RFC 1918 CIDR block, with a "/26" prefix, is required. The range cannot overlap with any\nprefixes either in the consumer VPC network or in use by the private clouds attached to that VPC network.\n  - `location` (`string`): The resource name of the location (region) to create the new network policy in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-central1\n  - `name` (`string`): The ID of the Network Policy.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:\nprojects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}\ncan either be a project number or a project ID.\n  - `external_ip` (`list[obj]`): Network service that allows External IP addresses to be assigned to VMware workloads.\nThis service can only be enabled when internetAccess is also enabled. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.external_ip.new](#fn-external_ipnew) constructor.\n  - `internet_access` (`list[obj]`): Network service that allows VMware workloads to access the internet. When `null`, the `internet_access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.internet_access.new](#fn-internet_accessnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_network_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    edge_services_cidr,
+    location,
+    name,
+    vmware_engine_network,
+    description=null,
+    external_ip=null,
+    internet_access=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    description: description,
+    edge_services_cidr: edge_services_cidr,
+    external_ip: external_ip,
+    internet_access: internet_access,
+    location: location,
+    name: name,
+    project: project,
+    timeouts: timeouts,
+    vmware_engine_network: vmware_engine_network,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_network_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withEdgeServicesCidr':: d.fn(help='`google.string.withEdgeServicesCidr` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the edge_services_cidr field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `edge_services_cidr` field.\n', args=[]),
+  withEdgeServicesCidr(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          edge_services_cidr: value,
+        },
+      },
+    },
+  },
+  '#withExternalIp':: d.fn(help='`google.list[obj].withExternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the external_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withExternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `external_ip` field.\n', args=[]),
+  withExternalIp(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          external_ip: value,
+        },
+      },
+    },
+  },
+  '#withExternalIpMixin':: d.fn(help='`google.list[obj].withExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the external_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withExternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `external_ip` field.\n', args=[]),
+  withExternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          external_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withInternetAccess':: d.fn(help='`google.list[obj].withInternetAccess` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the internet_access field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withInternetAccessMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `internet_access` field.\n', args=[]),
+  withInternetAccess(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          internet_access: value,
+        },
+      },
+    },
+  },
+  '#withInternetAccessMixin':: d.fn(help='`google.list[obj].withInternetAccessMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the internet_access field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withInternetAccess](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `internet_access` field.\n', args=[]),
+  withInternetAccessMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          internet_access+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVmwareEngineNetwork':: d.fn(help='`google.string.withVmwareEngineNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the vmware_engine_network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `vmware_engine_network` field.\n', args=[]),
+  withVmwareEngineNetwork(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_network_policy+: {
+        [resourceLabel]+: {
+          vmware_engine_network: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_private_cloud.libsonnet b/4.x/_gen/resources/vmwareengine_private_cloud.libsonnet
new file mode 100644
index 00000000..19dba758
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_private_cloud.libsonnet
@@ -0,0 +1,206 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_private_cloud', url='', help='`vmwareengine_private_cloud` represents the `google_vmwareengine_private_cloud` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  management_cluster:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_private_cloud.management_cluster.new` constructs a new object with attributes and blocks configured for the `management_cluster`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cluster_id` (`string`): The user-provided identifier of the new Cluster. The identifier must meet the following requirements:\n  * Only contains 1-63 alphanumeric characters and hyphens\n  * Begins with an alphabetical character\n  * Ends with a non-hyphen character\n  * Not formatted as a UUID\n  * Complies with RFC 1034 (https://datatracker.ietf.org/doc/html/rfc1034) (section 3.5)\n  - `node_type_configs` (`list[obj]`): The map of cluster node types in this cluster,\nwhere the key is canonical identifier of the node type (corresponds to the NodeType). When `null`, the `node_type_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.management_cluster.node_type_configs.new](#fn-management_clusternode_type_configsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `management_cluster` sub block.\n', args=[]),
+    new(
+      cluster_id,
+      node_type_configs=null
+    ):: std.prune(a={
+      cluster_id: cluster_id,
+      node_type_configs: node_type_configs,
+    }),
+    node_type_configs:: {
+      '#new':: d.fn(help='\n`google.vmwareengine_private_cloud.management_cluster.node_type_configs.new` constructs a new object with attributes and blocks configured for the `node_type_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `custom_core_count` (`number`): Customized number of cores available to each node of the type.\nThis number must always be one of 'nodeType.availableCustomCoreCounts'.\nIf zero is provided max value from 'nodeType.availableCustomCoreCounts' will be used.\nThis cannot be changed once the PrivateCloud is created. When `null`, the `custom_core_count` field will be omitted from the resulting object.\n  - `node_count` (`number`): The number of nodes of this type in the cluster.\n  - `node_type_id` (`string`): Set the `node_type_id` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_type_configs` sub block.\n', args=[]),
+      new(
+        node_count,
+        node_type_id,
+        custom_core_count=null
+      ):: std.prune(a={
+        custom_core_count: custom_core_count,
+        node_count: node_count,
+        node_type_id: node_type_id,
+      }),
+    },
+  },
+  network_config:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_private_cloud.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `management_cidr` (`string`): Management CIDR used by VMware management appliances.\n  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network attached to the private cloud.\nSpecify the name in the following form: projects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId}\nwhere {project} can either be a project number or a project ID. When `null`, the `vmware_engine_network` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      management_cidr,
+      vmware_engine_network=null
+    ):: std.prune(a={
+      management_cidr: management_cidr,
+      vmware_engine_network: vmware_engine_network,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.vmwareengine_private_cloud.new` injects a new `google_vmwareengine_private_cloud` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_private_cloud.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_private_cloud` using the reference:\n\n    $._ref.google_vmwareengine_private_cloud.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_private_cloud.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description for this private cloud. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the PrivateCloud should reside.\n  - `name` (`string`): The ID of the PrivateCloud.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Initial type of the private cloud. Possible values: [\u0026#34;STANDARD\u0026#34;, \u0026#34;TIME_LIMITED\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `management_cluster` (`list[obj]`): The management cluster for this private cloud. This used for creating and managing the default cluster. When `null`, the `management_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.management_cluster.new](#fn-management_clusternew) constructor.\n  - `network_config` (`list[obj]`): Network configuration in the consumer project with which the peering has to be done. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    description=null,
+    management_cluster=null,
+    network_config=null,
+    project=null,
+    timeouts=null,
+    type=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_private_cloud',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      location=location,
+      management_cluster=management_cluster,
+      name=name,
+      network_config=network_config,
+      project=project,
+      timeouts=timeouts,
+      type=type
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_private_cloud.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_private_cloud`\nTerraform resource.\n\nUnlike [google.vmwareengine_private_cloud.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description for this private cloud. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the PrivateCloud should reside.\n  - `name` (`string`): The ID of the PrivateCloud.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Initial type of the private cloud. Possible values: ["STANDARD", "TIME_LIMITED"] When `null`, the `type` field will be omitted from the resulting object.\n  - `management_cluster` (`list[obj]`): The management cluster for this private cloud. This used for creating and managing the default cluster. When `null`, the `management_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.management_cluster.new](#fn-management_clusternew) constructor.\n  - `network_config` (`list[obj]`): Network configuration in the consumer project with which the peering has to be done. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_private_cloud` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    description=null,
+    management_cluster=null,
+    network_config=null,
+    project=null,
+    timeouts=null,
+    type=null
+  ):: std.prune(a={
+    description: description,
+    location: location,
+    management_cluster: management_cluster,
+    name: name,
+    network_config: network_config,
+    project: project,
+    timeouts: timeouts,
+    type: type,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_private_cloud.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withManagementCluster':: d.fn(help='`google.list[obj].withManagementCluster` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the management_cluster field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withManagementClusterMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `management_cluster` field.\n', args=[]),
+  withManagementCluster(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          management_cluster: value,
+        },
+      },
+    },
+  },
+  '#withManagementClusterMixin':: d.fn(help='`google.list[obj].withManagementClusterMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the management_cluster field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withManagementCluster](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `management_cluster` field.\n', args=[]),
+  withManagementClusterMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          management_cluster+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_private_cloud+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/vmwareengine_subnet.libsonnet b/4.x/_gen/resources/vmwareengine_subnet.libsonnet
new file mode 100644
index 00000000..5ea76f2a
--- /dev/null
+++ b/4.x/_gen/resources/vmwareengine_subnet.libsonnet
@@ -0,0 +1,98 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='vmwareengine_subnet', url='', help='`vmwareengine_subnet` represents the `google_vmwareengine_subnet` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.vmwareengine_subnet.new` injects a new `google_vmwareengine_subnet` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vmwareengine_subnet.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vmwareengine_subnet` using the reference:\n\n    $._ref.google_vmwareengine_subnet.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vmwareengine_subnet.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ip_cidr_range` (`string`): The IP address range of the subnet in CIDR format.\n  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of \u0026#34;service-n\u0026#34;,\nwhere n ranges from 1 to 5.\n  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_subnet.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    ip_cidr_range,
+    name,
+    parent,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_vmwareengine_subnet',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      ip_cidr_range=ip_cidr_range,
+      name=name,
+      parent=parent,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.vmwareengine_subnet.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_subnet`\nTerraform resource.\n\nUnlike [google.vmwareengine_subnet.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ip_cidr_range` (`string`): The IP address range of the subnet in CIDR format.\n  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of "service-n",\nwhere n ranges from 1 to 5.\n  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.\nResource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.\nFor example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_subnet.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_subnet` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    ip_cidr_range,
+    name,
+    parent,
+    timeouts=null
+  ):: std.prune(a={
+    ip_cidr_range: ip_cidr_range,
+    name: name,
+    parent: parent,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.vmwareengine_subnet.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withIpCidrRange':: d.fn(help='`google.string.withIpCidrRange` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the ip_cidr_range field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `ip_cidr_range` field.\n', args=[]),
+  withIpCidrRange(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_subnet+: {
+        [resourceLabel]+: {
+          ip_cidr_range: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_subnet+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_subnet+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_subnet+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_vmwareengine_subnet+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/workbench_instance.libsonnet b/4.x/_gen/resources/workbench_instance.libsonnet
new file mode 100644
index 00000000..2ba51df2
--- /dev/null
+++ b/4.x/_gen/resources/workbench_instance.libsonnet
@@ -0,0 +1,276 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='workbench_instance', url='', help='`workbench_instance` represents the `google_workbench_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  gce_setup:: {
+    accelerator_configs:: {
+      '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.accelerator_configs.new` constructs a new object with attributes and blocks configured for the `accelerator_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `core_count` (`string`): Optional. Count of cores of this accelerator. When `null`, the `core_count` field will be omitted from the resulting object.\n  - `type` (`string`): Optional. Type of this accelerator. Possible values: ["NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_A100", "NVIDIA_A100_80GB", "NVIDIA_L4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS"] When `null`, the `type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `accelerator_configs` sub block.\n', args=[]),
+      new(
+        core_count=null,
+        type=null
+      ):: std.prune(a={
+        core_count: core_count,
+        type: type,
+      }),
+    },
+    boot_disk:: {
+      '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.boot_disk.new` constructs a new object with attributes and blocks configured for the `boot_disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disk_encryption` (`string`): Optional. Input only. Disk encryption method used on the boot and\ndata disks, defaults to GMEK. Possible values: ["GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `disk_size_gb` (`string`): Optional. The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). If not specified, this defaults to the\nrecommended value of 150GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Optional. Indicates the type of the disk. Possible values: ["PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `kms_key` (`string`): 'Optional. Input only. The KMS key used to encrypt the disks, only\napplicable if disk_encryption is CMEK. Format: 'projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id}'\nLearn more about using your own encryption keys.' When `null`, the `kms_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `boot_disk` sub block.\n', args=[]),
+      new(
+        disk_encryption=null,
+        disk_size_gb=null,
+        disk_type=null,
+        kms_key=null
+      ):: std.prune(a={
+        disk_encryption: disk_encryption,
+        disk_size_gb: disk_size_gb,
+        disk_type: disk_type,
+        kms_key: kms_key,
+      }),
+    },
+    data_disks:: {
+      '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.data_disks.new` constructs a new object with attributes and blocks configured for the `data_disks`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disk_encryption` (`string`): Optional. Input only. Disk encryption method used on the boot\nand data disks, defaults to GMEK. Possible values: ["GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `disk_size_gb` (`string`): Optional. The size of the disk in GB attached to this VM instance,\nup to a maximum of 64000 GB (64 TB). If not specified, this defaults to\n100. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Optional. Input only. Indicates the type of the disk. Possible values: ["PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `kms_key` (`string`): 'Optional. Input only. The KMS key used to encrypt the disks,\nonly applicable if disk_encryption is CMEK. Format: 'projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id}'\nLearn more about using your own encryption keys.' When `null`, the `kms_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `data_disks` sub block.\n', args=[]),
+      new(
+        disk_encryption=null,
+        disk_size_gb=null,
+        disk_type=null,
+        kms_key=null
+      ):: std.prune(a={
+        disk_encryption: disk_encryption,
+        disk_size_gb: disk_size_gb,
+        disk_type: disk_type,
+        kms_key: kms_key,
+      }),
+    },
+    network_interfaces:: {
+      '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.network_interfaces.new` constructs a new object with attributes and blocks configured for the `network_interfaces`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Optional. The name of the VPC that this VM instance is in. When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): Optional. The type of vNIC to be used on this interface. This\nmay be gVNIC or VirtioNet. Possible values: ["VIRTIO_NET", "GVNIC"] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `subnet` (`string`): Optional. The name of the subnet that this VM instance is in. When `null`, the `subnet` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `network_interfaces` sub block.\n', args=[]),
+      new(
+        network=null,
+        nic_type=null,
+        subnet=null
+      ):: std.prune(a={
+        network: network,
+        nic_type: nic_type,
+        subnet: subnet,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.new` constructs a new object with attributes and blocks configured for the `gce_setup`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disable_public_ip` (`bool`): Optional. If true, no external IP will be assigned to this VM instance. When `null`, the `disable_public_ip` field will be omitted from the resulting object.\n  - `enable_ip_forwarding` (`bool`): Optional. Flag to enable ip forwarding or not, default false/off.\nhttps://cloud.google.com/vpc/docs/using-routes#canipforward When `null`, the `enable_ip_forwarding` field will be omitted from the resulting object.\n  - `machine_type` (`string`): Optional. The machine type of the VM instance. https://cloud.google.com/compute/docs/machine-resource When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Optional. Custom metadata to apply to this instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `tags` (`list`): Optional. The Compute Engine tags to add to instance (see [Tagging\ninstances](https://cloud.google.com/compute/docs/label-or-tag-resources#tags)). When `null`, the `tags` field will be omitted from the resulting object.\n  - `accelerator_configs` (`list[obj]`): The hardware accelerators used on this instance. If you use accelerators, make sure that your configuration has\n[enough vCPUs and memory to support the 'machine_type' you have selected](https://cloud.google.com/compute/docs/gpus/#gpus-list).\nCurrently supports only one accelerator configuration. When `null`, the `accelerator_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.accelerator_configs.new](#fn-gce_setupaccelerator_configsnew) constructor.\n  - `boot_disk` (`list[obj]`): The definition of a boot disk. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.boot_disk.new](#fn-gce_setupboot_disknew) constructor.\n  - `data_disks` (`list[obj]`): Data disks attached to the VM instance. Currently supports only one data disk. When `null`, the `data_disks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.data_disks.new](#fn-gce_setupdata_disksnew) constructor.\n  - `network_interfaces` (`list[obj]`): The network interfaces for the VM. Supports only one interface. When `null`, the `network_interfaces` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.network_interfaces.new](#fn-gce_setupnetwork_interfacesnew) constructor.\n  - `service_accounts` (`list[obj]`): The service account that serves as an identity for the VM instance. Currently supports only one service account. When `null`, the `service_accounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.service_accounts.new](#fn-gce_setupservice_accountsnew) constructor.\n  - `vm_image` (`list[obj]`): Definition of a custom Compute Engine virtual machine image for starting\na workbench instance with the environment installed directly on the VM. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.vm_image.new](#fn-gce_setupvm_imagenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `gce_setup` sub block.\n', args=[]),
+    new(
+      accelerator_configs=null,
+      boot_disk=null,
+      data_disks=null,
+      disable_public_ip=null,
+      enable_ip_forwarding=null,
+      machine_type=null,
+      metadata=null,
+      network_interfaces=null,
+      service_accounts=null,
+      tags=null,
+      vm_image=null
+    ):: std.prune(a={
+      accelerator_configs: accelerator_configs,
+      boot_disk: boot_disk,
+      data_disks: data_disks,
+      disable_public_ip: disable_public_ip,
+      enable_ip_forwarding: enable_ip_forwarding,
+      machine_type: machine_type,
+      metadata: metadata,
+      network_interfaces: network_interfaces,
+      service_accounts: service_accounts,
+      tags: tags,
+      vm_image: vm_image,
+    }),
+    service_accounts:: {
+      '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.service_accounts.new` constructs a new object with attributes and blocks configured for the `service_accounts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `email` (`string`): Optional. Email address of the service account. When `null`, the `email` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `service_accounts` sub block.\n', args=[]),
+      new(
+        email=null
+      ):: std.prune(a={
+        email: email,
+      }),
+    },
+    vm_image:: {
+      '#new':: d.fn(help='\n`google.workbench_instance.gce_setup.vm_image.new` constructs a new object with attributes and blocks configured for the `vm_image`\nTerraform sub block.\n\n\n\n**Args**:\n  - `family` (`string`): Optional. Use this VM image family to find the image; the newest\nimage in this family will be used. When `null`, the `family` field will be omitted from the resulting object.\n  - `name` (`string`): Optional. Use VM image name to find the image. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): The name of the Google Cloud project that this VM image belongs to.\nFormat: {project_id} When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vm_image` sub block.\n', args=[]),
+      new(
+        family=null,
+        name=null,
+        project=null
+      ):: std.prune(a={
+        family: family,
+        name: name,
+        project: project,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.workbench_instance.new` injects a new `google_workbench_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workbench_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workbench_instance` using the reference:\n\n    $._ref.google_workbench_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workbench_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `disable_proxy_access` (`bool`): Optional. If true, the workbench instance will not register with the proxy. When `null`, the `disable_proxy_access` field will be omitted from the resulting object.\n  - `instance_id` (`string`): Required. User-defined unique ID of this instance. When `null`, the `instance_id` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): \u0026#39;Optional. Input only. The owner of this instance after creation. Format:\n\u0026#39;alias@example.com\u0026#39; Currently supports one owner only. If not specified, all of\nthe service account users of your VM instance\u0026#39;\u0026#39;s service account can use the instance.\u0026#39; When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels to apply to this instance. These can be later modified\nby the UpdateInstance method.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Part of \u0026#39;parent\u0026#39;. See documentation of \u0026#39;projectsId\u0026#39;.\n  - `name` (`string`): The name of this workbench instance. Format: \u0026#39;projects/{project_id}/locations/{location}/instances/{instance_id}\u0026#39;\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `gce_setup` (`list[obj]`): The definition of how to configure a VM instance outside of Resources and Identity. When `null`, the `gce_setup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.new](#fn-gce_setupnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    disable_proxy_access=null,
+    gce_setup=null,
+    instance_id=null,
+    instance_owners=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_workbench_instance',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      disable_proxy_access=disable_proxy_access,
+      gce_setup=gce_setup,
+      instance_id=instance_id,
+      instance_owners=instance_owners,
+      labels=labels,
+      location=location,
+      name=name,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.workbench_instance.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance`\nTerraform resource.\n\nUnlike [google.workbench_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `disable_proxy_access` (`bool`): Optional. If true, the workbench instance will not register with the proxy. When `null`, the `disable_proxy_access` field will be omitted from the resulting object.\n  - `instance_id` (`string`): Required. User-defined unique ID of this instance. When `null`, the `instance_id` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): 'Optional. Input only. The owner of this instance after creation. Format:\n'alias@example.com' Currently supports one owner only. If not specified, all of\nthe service account users of your VM instance''s service account can use the instance.' When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels to apply to this instance. These can be later modified\nby the UpdateInstance method.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Part of 'parent'. See documentation of 'projectsId'.\n  - `name` (`string`): The name of this workbench instance. Format: 'projects/{project_id}/locations/{location}/instances/{instance_id}'\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `gce_setup` (`list[obj]`): The definition of how to configure a VM instance outside of Resources and Identity. When `null`, the `gce_setup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.new](#fn-gce_setupnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    disable_proxy_access=null,
+    gce_setup=null,
+    instance_id=null,
+    instance_owners=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    disable_proxy_access: disable_proxy_access,
+    gce_setup: gce_setup,
+    instance_id: instance_id,
+    instance_owners: instance_owners,
+    labels: labels,
+    location: location,
+    name: name,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.workbench_instance.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDisableProxyAccess':: d.fn(help='`google.bool.withDisableProxyAccess` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the disable_proxy_access field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `disable_proxy_access` field.\n', args=[]),
+  withDisableProxyAccess(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          disable_proxy_access: value,
+        },
+      },
+    },
+  },
+  '#withGceSetup':: d.fn(help='`google.list[obj].withGceSetup` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gce_setup field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGceSetupMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gce_setup` field.\n', args=[]),
+  withGceSetup(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          gce_setup: value,
+        },
+      },
+    },
+  },
+  '#withGceSetupMixin':: d.fn(help='`google.list[obj].withGceSetupMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gce_setup field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGceSetup](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gce_setup` field.\n', args=[]),
+  withGceSetupMixin(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          gce_setup+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withInstanceId':: d.fn(help='`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the instance_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `instance_id` field.\n', args=[]),
+  withInstanceId(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          instance_id: value,
+        },
+      },
+    },
+  },
+  '#withInstanceOwners':: d.fn(help='`google.list.withInstanceOwners` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the instance_owners field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `instance_owners` field.\n', args=[]),
+  withInstanceOwners(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          instance_owners: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/workbench_instance_iam_binding.libsonnet b/4.x/_gen/resources/workbench_instance_iam_binding.libsonnet
new file mode 100644
index 00000000..8bc6d175
--- /dev/null
+++ b/4.x/_gen/resources/workbench_instance_iam_binding.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='workbench_instance_iam_binding', url='', help='`workbench_instance_iam_binding` represents the `google_workbench_instance_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.workbench_instance_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.workbench_instance_iam_binding.new` injects a new `google_workbench_instance_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workbench_instance_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workbench_instance_iam_binding` using the reference:\n\n    $._ref.google_workbench_instance_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workbench_instance_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    members,
+    name,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_workbench_instance_iam_binding',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      location=location,
+      members=members,
+      name=name,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.workbench_instance_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_binding`\nTerraform resource.\n\nUnlike [google.workbench_instance_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    members,
+    name,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    location: location,
+    members: members,
+    name: name,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
+  withMembers(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          members: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_binding+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/cloudiot_registry_iam_binding.libsonnet b/4.x/_gen/resources/workbench_instance_iam_member.libsonnet
similarity index 57%
rename from 4.x/_gen/resources/cloudiot_registry_iam_binding.libsonnet
rename to 4.x/_gen/resources/workbench_instance_iam_member.libsonnet
index af626f2d..3fd16883 100644
--- a/4.x/_gen/resources/cloudiot_registry_iam_binding.libsonnet
+++ b/4.x/_gen/resources/workbench_instance_iam_member.libsonnet
@@ -1,9 +1,9 @@
 local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
-  '#':: d.pkg(name='cloudiot_registry_iam_binding', url='', help='`cloudiot_registry_iam_binding` represents the `google_cloudiot_registry_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#':: d.pkg(name='workbench_instance_iam_member', url='', help='`workbench_instance_iam_member` represents the `google_workbench_instance_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   condition:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.workbench_instance_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
     new(
       expression,
       title,
@@ -14,49 +14,49 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       title: title,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudiot_registry_iam_binding.new` injects a new `google_cloudiot_registry_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry_iam_binding` using the reference:\n\n    $._ref.google_cloudiot_registry_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.workbench_instance_iam_member.new` injects a new `google_workbench_instance_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workbench_instance_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workbench_instance_iam_member` using the reference:\n\n    $._ref.google_workbench_instance_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workbench_instance_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
-    members,
+    member,
     name,
     role,
     condition=null,
+    location=null,
     project=null,
-    region=null,
     _meta={}
   ):: tf.withResource(
-    type='google_cloudiot_registry_iam_binding',
+    type='google_workbench_instance_iam_member',
     label=resourceLabel,
     attrs=self.newAttrs(
       condition=condition,
-      members=members,
+      location=location,
+      member=member,
       name=name,
       project=project,
-      region=region,
       role=role
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_binding`\nTerraform resource.\n\nUnlike [google.cloudiot_registry_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.workbench_instance_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_member`\nTerraform resource.\n\nUnlike [google.workbench_instance_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance_iam_member` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
-    members,
+    member,
     name,
     role,
     condition=null,
-    project=null,
-    region=null
+    location=null,
+    project=null
   ):: std.prune(a={
     condition: condition,
-    members: members,
+    location: location,
+    member: member,
     name: name,
     project: project,
-    region: region,
     role: role,
   }),
   '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
   withCondition(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
           condition: value,
         },
@@ -66,49 +66,49 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
   withConditionMixin(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
           condition+: if std.isArray(v=value) then value else [value],
         },
       },
     },
   },
-  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
-  withMembers(resourceLabel, value): {
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
-          members: value,
+          location: value,
         },
       },
     },
   },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
+  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
+  withMember(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
-          name: value,
+          member: value,
         },
       },
     },
   },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
-          project: value,
+          name: value,
         },
       },
     },
   },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
-          region: value,
+          project: value,
         },
       },
     },
@@ -116,7 +116,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
   withRole(resourceLabel, value): {
     resource+: {
-      google_cloudiot_registry_iam_binding+: {
+      google_workbench_instance_iam_member+: {
         [resourceLabel]+: {
           role: value,
         },
diff --git a/4.x/_gen/resources/workbench_instance_iam_policy.libsonnet b/4.x/_gen/resources/workbench_instance_iam_policy.libsonnet
new file mode 100644
index 00000000..db219651
--- /dev/null
+++ b/4.x/_gen/resources/workbench_instance_iam_policy.libsonnet
@@ -0,0 +1,76 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='workbench_instance_iam_policy', url='', help='`workbench_instance_iam_policy` represents the `google_workbench_instance_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.workbench_instance_iam_policy.new` injects a new `google_workbench_instance_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workbench_instance_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workbench_instance_iam_policy` using the reference:\n\n    $._ref.google_workbench_instance_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workbench_instance_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    policy_data,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_workbench_instance_iam_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      location=location,
+      name=name,
+      policy_data=policy_data,
+      project=project
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.workbench_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_policy`\nTerraform resource.\n\nUnlike [google.workbench_instance_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    policy_data,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    policy_data: policy_data,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_policy+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
+  withPolicyData(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_policy+: {
+        [resourceLabel]+: {
+          policy_data: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_workbench_instance_iam_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/workflows_workflow.libsonnet b/4.x/_gen/resources/workflows_workflow.libsonnet
index 9faaae1e..51c6cd29 100644
--- a/4.x/_gen/resources/workflows_workflow.libsonnet
+++ b/4.x/_gen/resources/workflows_workflow.libsonnet
@@ -2,9 +2,10 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='workflows_workflow', url='', help='`workflows_workflow` represents the `google_workflows_workflow` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.workflows_workflow.new` injects a new `google_workflows_workflow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workflows_workflow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workflows_workflow` using the reference:\n\n    $._ref.google_workflows_workflow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workflows_workflow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting resource block. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project\u0026#39;s default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.workflows_workflow.new` injects a new `google_workflows_workflow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workflows_workflow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workflows_workflow` using the reference:\n\n    $._ref.google_workflows_workflow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workflows_workflow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `call_log_level` (`string`): Describes the level of platform logging to apply to calls and call responses during\nexecutions of this workflow. If both the workflow and the execution specify a logging level,\nthe execution level takes precedence. Possible values: [\u0026#34;CALL_LOG_LEVEL_UNSPECIFIED\u0026#34;, \u0026#34;LOG_ALL_CALLS\u0026#34;, \u0026#34;LOG_ERRORS_ONLY\u0026#34;, \u0026#34;LOG_NONE\u0026#34;] When `null`, the `call_log_level` field will be omitted from the resulting object.\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting resource block. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project\u0026#39;s default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 128KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `user_env_vars` (`obj`): User-defined environment variables associated with this workflow revision. This map has a maximum length of 20. Each string can take up to 4KiB. Keys cannot be empty strings and cannot start with “GOOGLE” or “WORKFLOWS\u0026#34;. When `null`, the `user_env_vars` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    call_log_level=null,
     crypto_key_name=null,
     description=null,
     labels=null,
@@ -15,11 +16,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     service_account=null,
     source_contents=null,
     timeouts=null,
+    user_env_vars=null,
     _meta={}
   ):: tf.withResource(
     type='google_workflows_workflow',
     label=resourceLabel,
     attrs=self.newAttrs(
+      call_log_level=call_log_level,
       crypto_key_name=crypto_key_name,
       description=description,
       labels=labels,
@@ -29,12 +32,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       region=region,
       service_account=service_account,
       source_contents=source_contents,
-      timeouts=timeouts
+      timeouts=timeouts,
+      user_env_vars=user_env_vars
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.workflows_workflow.newAttrs` constructs a new object with attributes and blocks configured for the `workflows_workflow`\nTerraform resource.\n\nUnlike [google.workflows_workflow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting object. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project's default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workflows_workflow` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.workflows_workflow.newAttrs` constructs a new object with attributes and blocks configured for the `workflows_workflow`\nTerraform resource.\n\nUnlike [google.workflows_workflow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `call_log_level` (`string`): Describes the level of platform logging to apply to calls and call responses during\nexecutions of this workflow. If both the workflow and the execution specify a logging level,\nthe execution level takes precedence. Possible values: ["CALL_LOG_LEVEL_UNSPECIFIED", "LOG_ALL_CALLS", "LOG_ERRORS_ONLY", "LOG_NONE"] When `null`, the `call_log_level` field will be omitted from the resulting object.\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting object. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project's default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 128KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `user_env_vars` (`obj`): User-defined environment variables associated with this workflow revision. This map has a maximum length of 20. Each string can take up to 4KiB. Keys cannot be empty strings and cannot start with “GOOGLE” or “WORKFLOWS". When `null`, the `user_env_vars` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workflows_workflow` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    call_log_level=null,
     crypto_key_name=null,
     description=null,
     labels=null,
@@ -44,8 +49,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     region=null,
     service_account=null,
     source_contents=null,
-    timeouts=null
+    timeouts=null,
+    user_env_vars=null
   ):: std.prune(a={
+    call_log_level: call_log_level,
     crypto_key_name: crypto_key_name,
     description: description,
     labels: labels,
@@ -56,6 +63,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     service_account: service_account,
     source_contents: source_contents,
     timeouts: timeouts,
+    user_env_vars: user_env_vars,
   }),
   timeouts:: {
     '#new':: d.fn(help='\n`google.workflows_workflow.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -69,6 +77,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withCallLogLevel':: d.fn(help='`google.string.withCallLogLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the call_log_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `call_log_level` field.\n', args=[]),
+  withCallLogLevel(resourceLabel, value): {
+    resource+: {
+      google_workflows_workflow+: {
+        [resourceLabel]+: {
+          call_log_level: value,
+        },
+      },
+    },
+  },
   '#withCryptoKeyName':: d.fn(help='`google.string.withCryptoKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the crypto_key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `crypto_key_name` field.\n', args=[]),
   withCryptoKeyName(resourceLabel, value): {
     resource+: {
@@ -179,4 +197,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withUserEnvVars':: d.fn(help='`google.obj.withUserEnvVars` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the user_env_vars field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `user_env_vars` field.\n', args=[]),
+  withUserEnvVars(resourceLabel, value): {
+    resource+: {
+      google_workflows_workflow+: {
+        [resourceLabel]+: {
+          user_env_vars: value,
+        },
+      },
+    },
+  },
 }
diff --git a/docs/4.x/README.md b/docs/4.x/README.md
index d451320c..e6f8d8f9 100644
--- a/docs/4.x/README.md
+++ b/docs/4.x/README.md
@@ -32,6 +32,7 @@ project.
 * [alloydb_backup](alloydb_backup.md)
 * [alloydb_cluster](alloydb_cluster.md)
 * [alloydb_instance](alloydb_instance.md)
+* [alloydb_user](alloydb_user.md)
 * [apigee_addons_config](apigee_addons_config.md)
 * [apigee_endpoint_attachment](apigee_endpoint_attachment.md)
 * [apigee_env_keystore](apigee_env_keystore.md)
@@ -127,6 +128,7 @@ project.
 * [binary_authorization_attestor_iam_member](binary_authorization_attestor_iam_member.md)
 * [binary_authorization_attestor_iam_policy](binary_authorization_attestor_iam_policy.md)
 * [binary_authorization_policy](binary_authorization_policy.md)
+* [blockchain_node_engine_blockchain_nodes](blockchain_node_engine_blockchain_nodes.md)
 * [certificate_manager_certificate](certificate_manager_certificate.md)
 * [certificate_manager_certificate_issuance_config](certificate_manager_certificate_issuance_config.md)
 * [certificate_manager_certificate_map](certificate_manager_certificate_map.md)
@@ -167,6 +169,7 @@ project.
 * [cloudbuildv2_repository](cloudbuildv2_repository.md)
 * [clouddeploy_delivery_pipeline](clouddeploy_delivery_pipeline.md)
 * [clouddeploy_target](clouddeploy_target.md)
+* [clouddomains_registration](clouddomains_registration.md)
 * [cloudfunctions2_function](cloudfunctions2_function.md)
 * [cloudfunctions2_function_iam_binding](cloudfunctions2_function_iam_binding.md)
 * [cloudfunctions2_function_iam_member](cloudfunctions2_function_iam_member.md)
@@ -175,11 +178,6 @@ project.
 * [cloudfunctions_function_iam_binding](cloudfunctions_function_iam_binding.md)
 * [cloudfunctions_function_iam_member](cloudfunctions_function_iam_member.md)
 * [cloudfunctions_function_iam_policy](cloudfunctions_function_iam_policy.md)
-* [cloudiot_device](cloudiot_device.md)
-* [cloudiot_registry](cloudiot_registry.md)
-* [cloudiot_registry_iam_binding](cloudiot_registry_iam_binding.md)
-* [cloudiot_registry_iam_member](cloudiot_registry_iam_member.md)
-* [cloudiot_registry_iam_policy](cloudiot_registry_iam_policy.md)
 * [composer_environment](composer_environment.md)
 * [compute_address](compute_address.md)
 * [compute_attached_disk](compute_attached_disk.md)
@@ -252,6 +250,7 @@ project.
 * [compute_region_health_check](compute_region_health_check.md)
 * [compute_region_instance_group_manager](compute_region_instance_group_manager.md)
 * [compute_region_instance_template](compute_region_instance_template.md)
+* [compute_region_network_endpoint](compute_region_network_endpoint.md)
 * [compute_region_network_endpoint_group](compute_region_network_endpoint_group.md)
 * [compute_region_network_firewall_policy](compute_region_network_firewall_policy.md)
 * [compute_region_network_firewall_policy_association](compute_region_network_firewall_policy_association.md)
@@ -337,6 +336,7 @@ project.
 * [data_loss_prevention_stored_info_type](data_loss_prevention_stored_info_type.md)
 * [data_pipeline_pipeline](data_pipeline_pipeline.md)
 * [database_migration_service_connection_profile](database_migration_service_connection_profile.md)
+* [database_migration_service_private_connection](database_migration_service_private_connection.md)
 * [dataflow_job](dataflow_job.md)
 * [dataplex_asset](dataplex_asset.md)
 * [dataplex_asset_iam_binding](dataplex_asset_iam_binding.md)
@@ -394,6 +394,9 @@ project.
 * [dialogflow_entity_type](dialogflow_entity_type.md)
 * [dialogflow_fulfillment](dialogflow_fulfillment.md)
 * [dialogflow_intent](dialogflow_intent.md)
+* [discovery_engine_chat_engine](discovery_engine_chat_engine.md)
+* [discovery_engine_data_store](discovery_engine_data_store.md)
+* [discovery_engine_search_engine](discovery_engine_search_engine.md)
 * [dns_managed_zone](dns_managed_zone.md)
 * [dns_managed_zone_iam_binding](dns_managed_zone_iam_binding.md)
 * [dns_managed_zone_iam_member](dns_managed_zone_iam_member.md)
@@ -406,6 +409,9 @@ project.
 * [document_ai_processor_default_version](document_ai_processor_default_version.md)
 * [document_ai_warehouse_document_schema](document_ai_warehouse_document_schema.md)
 * [document_ai_warehouse_location](document_ai_warehouse_location.md)
+* [edgecontainer_cluster](edgecontainer_cluster.md)
+* [edgecontainer_node_pool](edgecontainer_node_pool.md)
+* [edgecontainer_vpn_connection](edgecontainer_vpn_connection.md)
 * [edgenetwork_network](edgenetwork_network.md)
 * [edgenetwork_subnet](edgenetwork_subnet.md)
 * [endpoints_service](endpoints_service.md)
@@ -424,6 +430,7 @@ project.
 * [filestore_snapshot](filestore_snapshot.md)
 * [firebaserules_release](firebaserules_release.md)
 * [firebaserules_ruleset](firebaserules_ruleset.md)
+* [firestore_backup_schedule](firestore_backup_schedule.md)
 * [firestore_database](firestore_database.md)
 * [firestore_document](firestore_document.md)
 * [firestore_field](firestore_field.md)
@@ -435,11 +442,6 @@ project.
 * [folder_iam_member](folder_iam_member.md)
 * [folder_iam_policy](folder_iam_policy.md)
 * [folder_organization_policy](folder_organization_policy.md)
-* [game_services_game_server_cluster](game_services_game_server_cluster.md)
-* [game_services_game_server_config](game_services_game_server_config.md)
-* [game_services_game_server_deployment](game_services_game_server_deployment.md)
-* [game_services_game_server_deployment_rollout](game_services_game_server_deployment_rollout.md)
-* [game_services_realm](game_services_realm.md)
 * [gke_backup_backup_plan](gke_backup_backup_plan.md)
 * [gke_backup_backup_plan_iam_binding](gke_backup_backup_plan_iam_binding.md)
 * [gke_backup_backup_plan_iam_member](gke_backup_backup_plan_iam_member.md)
@@ -453,6 +455,7 @@ project.
 * [gke_hub_feature_iam_member](gke_hub_feature_iam_member.md)
 * [gke_hub_feature_iam_policy](gke_hub_feature_iam_policy.md)
 * [gke_hub_feature_membership](gke_hub_feature_membership.md)
+* [gke_hub_fleet](gke_hub_fleet.md)
 * [gke_hub_membership](gke_hub_membership.md)
 * [gke_hub_membership_binding](gke_hub_membership_binding.md)
 * [gke_hub_membership_iam_binding](gke_hub_membership_iam_binding.md)
@@ -464,6 +467,11 @@ project.
 * [gke_hub_scope_iam_member](gke_hub_scope_iam_member.md)
 * [gke_hub_scope_iam_policy](gke_hub_scope_iam_policy.md)
 * [gke_hub_scope_rbac_role_binding](gke_hub_scope_rbac_role_binding.md)
+* [gkeonprem_bare_metal_admin_cluster](gkeonprem_bare_metal_admin_cluster.md)
+* [gkeonprem_bare_metal_cluster](gkeonprem_bare_metal_cluster.md)
+* [gkeonprem_bare_metal_node_pool](gkeonprem_bare_metal_node_pool.md)
+* [gkeonprem_vmware_cluster](gkeonprem_vmware_cluster.md)
+* [gkeonprem_vmware_node_pool](gkeonprem_vmware_node_pool.md)
 * [healthcare_consent_store](healthcare_consent_store.md)
 * [healthcare_consent_store_iam_binding](healthcare_consent_store_iam_binding.md)
 * [healthcare_consent_store_iam_member](healthcare_consent_store_iam_member.md)
@@ -528,6 +536,8 @@ project.
 * [identity_platform_tenant_default_supported_idp_config](identity_platform_tenant_default_supported_idp_config.md)
 * [identity_platform_tenant_inbound_saml_config](identity_platform_tenant_inbound_saml_config.md)
 * [identity_platform_tenant_oauth_idp_config](identity_platform_tenant_oauth_idp_config.md)
+* [integration_connectors_connection](integration_connectors_connection.md)
+* [integration_connectors_endpoint_attachment](integration_connectors_endpoint_attachment.md)
 * [kms_crypto_key](kms_crypto_key.md)
 * [kms_crypto_key_iam_binding](kms_crypto_key_iam_binding.md)
 * [kms_crypto_key_iam_member](kms_crypto_key_iam_member.md)
@@ -544,18 +554,21 @@ project.
 * [logging_billing_account_sink](logging_billing_account_sink.md)
 * [logging_folder_bucket_config](logging_folder_bucket_config.md)
 * [logging_folder_exclusion](logging_folder_exclusion.md)
+* [logging_folder_settings](logging_folder_settings.md)
 * [logging_folder_sink](logging_folder_sink.md)
 * [logging_linked_dataset](logging_linked_dataset.md)
 * [logging_log_view](logging_log_view.md)
 * [logging_metric](logging_metric.md)
 * [logging_organization_bucket_config](logging_organization_bucket_config.md)
 * [logging_organization_exclusion](logging_organization_exclusion.md)
+* [logging_organization_settings](logging_organization_settings.md)
 * [logging_organization_sink](logging_organization_sink.md)
 * [logging_project_bucket_config](logging_project_bucket_config.md)
 * [logging_project_exclusion](logging_project_exclusion.md)
 * [logging_project_sink](logging_project_sink.md)
 * [looker_instance](looker_instance.md)
 * [memcache_instance](memcache_instance.md)
+* [migration_center_group](migration_center_group.md)
 * [ml_engine_model](ml_engine_model.md)
 * [monitoring_alert_policy](monitoring_alert_policy.md)
 * [monitoring_custom_service](monitoring_custom_service.md)
@@ -567,11 +580,22 @@ project.
 * [monitoring_service](monitoring_service.md)
 * [monitoring_slo](monitoring_slo.md)
 * [monitoring_uptime_check_config](monitoring_uptime_check_config.md)
+* [netapp_active_directory](netapp_active_directory.md)
+* [netapp_backup_policy](netapp_backup_policy.md)
+* [netapp_backup_vault](netapp_backup_vault.md)
+* [netapp_kmsconfig](netapp_kmsconfig.md)
+* [netapp_storage_pool](netapp_storage_pool.md)
+* [netapp_volume](netapp_volume.md)
+* [netapp_volume_snapshot](netapp_volume_snapshot.md)
 * [network_connectivity_hub](network_connectivity_hub.md)
+* [network_connectivity_policy_based_route](network_connectivity_policy_based_route.md)
 * [network_connectivity_service_connection_policy](network_connectivity_service_connection_policy.md)
 * [network_connectivity_spoke](network_connectivity_spoke.md)
 * [network_management_connectivity_test](network_management_connectivity_test.md)
 * [network_security_address_group](network_security_address_group.md)
+* [network_security_address_group_iam_binding](network_security_address_group_iam_binding.md)
+* [network_security_address_group_iam_member](network_security_address_group_iam_member.md)
+* [network_security_address_group_iam_policy](network_security_address_group_iam_policy.md)
 * [network_security_gateway_security_policy](network_security_gateway_security_policy.md)
 * [network_security_gateway_security_policy_rule](network_security_gateway_security_policy_rule.md)
 * [network_security_url_lists](network_security_url_lists.md)
@@ -589,6 +613,7 @@ project.
 * [notebooks_runtime_iam_binding](notebooks_runtime_iam_binding.md)
 * [notebooks_runtime_iam_member](notebooks_runtime_iam_member.md)
 * [notebooks_runtime_iam_policy](notebooks_runtime_iam_policy.md)
+* [org_policy_custom_constraint](org_policy_custom_constraint.md)
 * [org_policy_policy](org_policy_policy.md)
 * [organization_access_approval_settings](organization_access_approval_settings.md)
 * [organization_iam_audit_config](organization_iam_audit_config.md)
@@ -627,6 +652,9 @@ project.
 * [pubsub_lite_subscription](pubsub_lite_subscription.md)
 * [pubsub_lite_topic](pubsub_lite_topic.md)
 * [pubsub_schema](pubsub_schema.md)
+* [pubsub_schema_iam_binding](pubsub_schema_iam_binding.md)
+* [pubsub_schema_iam_member](pubsub_schema_iam_member.md)
+* [pubsub_schema_iam_policy](pubsub_schema_iam_policy.md)
 * [pubsub_subscription](pubsub_subscription.md)
 * [pubsub_subscription_iam_binding](pubsub_subscription_iam_binding.md)
 * [pubsub_subscription_iam_member](pubsub_subscription_iam_member.md)
@@ -636,10 +664,14 @@ project.
 * [pubsub_topic_iam_member](pubsub_topic_iam_member.md)
 * [pubsub_topic_iam_policy](pubsub_topic_iam_policy.md)
 * [recaptcha_enterprise_key](recaptcha_enterprise_key.md)
+* [redis_cluster](redis_cluster.md)
 * [redis_instance](redis_instance.md)
 * [resource_manager_lien](resource_manager_lien.md)
+* [scc_event_threat_detection_custom_module](scc_event_threat_detection_custom_module.md)
+* [scc_folder_custom_module](scc_folder_custom_module.md)
 * [scc_mute_config](scc_mute_config.md)
 * [scc_notification_config](scc_notification_config.md)
+* [scc_organization_custom_module](scc_organization_custom_module.md)
 * [scc_project_custom_module](scc_project_custom_module.md)
 * [scc_source](scc_source.md)
 * [scc_source_iam_binding](scc_source_iam_binding.md)
@@ -650,6 +682,12 @@ project.
 * [secret_manager_secret_iam_member](secret_manager_secret_iam_member.md)
 * [secret_manager_secret_iam_policy](secret_manager_secret_iam_policy.md)
 * [secret_manager_secret_version](secret_manager_secret_version.md)
+* [secure_source_manager_instance](secure_source_manager_instance.md)
+* [secure_source_manager_instance_iam_binding](secure_source_manager_instance_iam_binding.md)
+* [secure_source_manager_instance_iam_member](secure_source_manager_instance_iam_member.md)
+* [secure_source_manager_instance_iam_policy](secure_source_manager_instance_iam_policy.md)
+* [securityposture_posture](securityposture_posture.md)
+* [securityposture_posture_deployment](securityposture_posture_deployment.md)
 * [service_account](service_account.md)
 * [service_account_iam_binding](service_account_iam_binding.md)
 * [service_account_iam_member](service_account_iam_member.md)
@@ -703,11 +741,27 @@ project.
 * [tpu_node](tpu_node.md)
 * [vertex_ai_dataset](vertex_ai_dataset.md)
 * [vertex_ai_endpoint](vertex_ai_endpoint.md)
+* [vertex_ai_feature_group](vertex_ai_feature_group.md)
+* [vertex_ai_feature_group_feature](vertex_ai_feature_group_feature.md)
+* [vertex_ai_feature_online_store](vertex_ai_feature_online_store.md)
+* [vertex_ai_feature_online_store_featureview](vertex_ai_feature_online_store_featureview.md)
 * [vertex_ai_featurestore](vertex_ai_featurestore.md)
 * [vertex_ai_featurestore_entitytype](vertex_ai_featurestore_entitytype.md)
 * [vertex_ai_featurestore_entitytype_feature](vertex_ai_featurestore_entitytype_feature.md)
 * [vertex_ai_index](vertex_ai_index.md)
 * [vertex_ai_index_endpoint](vertex_ai_index_endpoint.md)
 * [vertex_ai_tensorboard](vertex_ai_tensorboard.md)
+* [vmwareengine_cluster](vmwareengine_cluster.md)
+* [vmwareengine_external_access_rule](vmwareengine_external_access_rule.md)
+* [vmwareengine_external_address](vmwareengine_external_address.md)
+* [vmwareengine_network](vmwareengine_network.md)
+* [vmwareengine_network_peering](vmwareengine_network_peering.md)
+* [vmwareengine_network_policy](vmwareengine_network_policy.md)
+* [vmwareengine_private_cloud](vmwareengine_private_cloud.md)
+* [vmwareengine_subnet](vmwareengine_subnet.md)
 * [vpc_access_connector](vpc_access_connector.md)
+* [workbench_instance](workbench_instance.md)
+* [workbench_instance_iam_binding](workbench_instance_iam_binding.md)
+* [workbench_instance_iam_member](workbench_instance_iam_member.md)
+* [workbench_instance_iam_policy](workbench_instance_iam_policy.md)
 * [workflows_workflow](workflows_workflow.md)
\ No newline at end of file
diff --git a/docs/4.x/access_context_manager_access_level.md b/docs/4.x/access_context_manager_access_level.md
index cdb5dda9..e6012799 100644
--- a/docs/4.x/access_context_manager_access_level.md
+++ b/docs/4.x/access_context_manager_access_level.md
@@ -33,6 +33,10 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-basicconditionsdevice_policynew)
       * [`obj basic.conditions.device_policy.os_constraints`](#obj-basicconditionsdevice_policyos_constraints)
         * [`fn new()`](#fn-basicconditionsdevice_policyos_constraintsnew)
+    * [`obj basic.conditions.vpc_network_sources`](#obj-basicconditionsvpc_network_sources)
+      * [`fn new()`](#fn-basicconditionsvpc_network_sourcesnew)
+      * [`obj basic.conditions.vpc_network_sources.vpc_subnetwork`](#obj-basicconditionsvpc_network_sourcesvpc_subnetwork)
+        * [`fn new()`](#fn-basicconditionsvpc_network_sourcesvpc_subnetworknew)
 * [`obj custom`](#obj-custom)
   * [`fn new()`](#fn-customnew)
   * [`obj custom.expr`](#obj-customexpr)
@@ -370,6 +374,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
   - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.device_policy.new](#fn-basicbasicdevice_policynew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new](#fn-basicbasicvpc_network_sourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `conditions` sub block.
@@ -434,6 +439,53 @@ Format: "major.minor.patch" such as "10.5.301", "9.2.1".
   - An attribute object that represents the `os_constraints` sub block.
 
 
+## obj basic.conditions.vpc_network_sources
+
+
+
+### fn basic.conditions.vpc_network_sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-basicbasicconditionsvpc_subnetworknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vpc_network_sources` sub block.
+
+
+## obj basic.conditions.vpc_network_sources.vpc_subnetwork
+
+
+
+### fn basic.conditions.vpc_network_sources.vpc_subnetwork.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.
+  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_subnetwork` sub block.
+
+
 ## obj custom
 
 
diff --git a/docs/4.x/access_context_manager_access_level_condition.md b/docs/4.x/access_context_manager_access_level_condition.md
index e448f1ba..1d79e5fd 100644
--- a/docs/4.x/access_context_manager_access_level_condition.md
+++ b/docs/4.x/access_context_manager_access_level_condition.md
@@ -25,12 +25,18 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRequiredAccessLevels()`](#fn-withrequiredaccesslevels)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVpcNetworkSources()`](#fn-withvpcnetworksources)
+* [`fn withVpcNetworkSourcesMixin()`](#fn-withvpcnetworksourcesmixin)
 * [`obj device_policy`](#obj-device_policy)
   * [`fn new()`](#fn-device_policynew)
   * [`obj device_policy.os_constraints`](#obj-device_policyos_constraints)
     * [`fn new()`](#fn-device_policyos_constraintsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
+* [`obj vpc_network_sources`](#obj-vpc_network_sources)
+  * [`fn new()`](#fn-vpc_network_sourcesnew)
+  * [`obj vpc_network_sources.vpc_subnetwork`](#obj-vpc_network_sourcesvpc_subnetwork)
+    * [`fn new()`](#fn-vpc_network_sourcesvpc_subnetworknew)
 
 ## Fields
 
@@ -95,6 +101,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -152,6 +159,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_access_level_condition` resource into the root Terraform configuration.
@@ -326,6 +334,43 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withVpcNetworkSources
+
+```ts
+withVpcNetworkSources()
+```
+
+`google.list[obj].withVpcNetworkSources` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_network_sources field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVpcNetworkSourcesMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.
+
+
+### fn withVpcNetworkSourcesMixin
+
+```ts
+withVpcNetworkSourcesMixin()
+```
+
+`google.list[obj].withVpcNetworkSourcesMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_network_sources field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVpcNetworkSources](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.
+
+
 ## obj device_policy
 
 
@@ -406,3 +451,50 @@ Terraform sub block.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
+
+
+## obj vpc_network_sources
+
+
+
+### fn vpc_network_sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level_condition.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new](#fn-vpc_network_sourcesvpc_subnetworknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vpc_network_sources` sub block.
+
+
+## obj vpc_network_sources.vpc_subnetwork
+
+
+
+### fn vpc_network_sources.vpc_subnetwork.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.
+  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_subnetwork` sub block.
diff --git a/docs/4.x/access_context_manager_access_levels.md b/docs/4.x/access_context_manager_access_levels.md
index 19d08f34..671106cd 100644
--- a/docs/4.x/access_context_manager_access_levels.md
+++ b/docs/4.x/access_context_manager_access_levels.md
@@ -30,6 +30,10 @@ This package contains functions and utilities for setting up the resource using
         * [`fn new()`](#fn-access_levelsbasicconditionsdevice_policynew)
         * [`obj access_levels.basic.conditions.device_policy.os_constraints`](#obj-access_levelsbasicconditionsdevice_policyos_constraints)
           * [`fn new()`](#fn-access_levelsbasicconditionsdevice_policyos_constraintsnew)
+      * [`obj access_levels.basic.conditions.vpc_network_sources`](#obj-access_levelsbasicconditionsvpc_network_sources)
+        * [`fn new()`](#fn-access_levelsbasicconditionsvpc_network_sourcesnew)
+        * [`obj access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork`](#obj-access_levelsbasicconditionsvpc_network_sourcesvpc_subnetwork)
+          * [`fn new()`](#fn-access_levelsbasicconditionsvpc_network_sourcesvpc_subnetworknew)
   * [`obj access_levels.custom`](#obj-access_levelscustom)
     * [`fn new()`](#fn-access_levelscustomnew)
     * [`obj access_levels.custom.expr`](#obj-access_levelscustomexpr)
@@ -298,6 +302,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
   - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.device_policy.new](#fn-access_levelsaccess_levelsbasicdevice_policynew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new](#fn-access_levelsaccess_levelsbasicvpc_network_sourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `conditions` sub block.
@@ -361,6 +366,53 @@ Format: "major.minor.patch" such as "10.5.301", "9.2.1".
   - An attribute object that represents the `os_constraints` sub block.
 
 
+## obj access_levels.basic.conditions.vpc_network_sources
+
+
+
+### fn access_levels.basic.conditions.vpc_network_sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-access_levelsaccess_levelsbasicconditionsvpc_subnetworknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vpc_network_sources` sub block.
+
+
+## obj access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork
+
+
+
+### fn access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.
+  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_subnetwork` sub block.
+
+
 ## obj access_levels.custom
 
 
diff --git a/docs/4.x/access_context_manager_service_perimeter.md b/docs/4.x/access_context_manager_service_perimeter.md
index 84806e69..b89eb75d 100644
--- a/docs/4.x/access_context_manager_service_perimeter.md
+++ b/docs/4.x/access_context_manager_service_perimeter.md
@@ -33,6 +33,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-specegress_policiesnew)
     * [`obj spec.egress_policies.egress_from`](#obj-specegress_policiesegress_from)
       * [`fn new()`](#fn-specegress_policiesegress_fromnew)
+      * [`obj spec.egress_policies.egress_from.sources`](#obj-specegress_policiesegress_fromsources)
+        * [`fn new()`](#fn-specegress_policiesegress_fromsourcesnew)
     * [`obj spec.egress_policies.egress_to`](#obj-specegress_policiesegress_to)
       * [`fn new()`](#fn-specegress_policiesegress_tonew)
       * [`obj spec.egress_policies.egress_to.operations`](#obj-specegress_policiesegress_tooperations)
@@ -59,6 +61,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-statusegress_policiesnew)
     * [`obj status.egress_policies.egress_from`](#obj-statusegress_policiesegress_from)
       * [`fn new()`](#fn-statusegress_policiesegress_fromnew)
+      * [`obj status.egress_policies.egress_from.sources`](#obj-statusegress_policiesegress_fromsources)
+        * [`fn new()`](#fn-statusegress_policiesegress_fromsourcesnew)
     * [`obj status.egress_policies.egress_to`](#obj-statusegress_policiesegress_to)
       * [`fn new()`](#fn-statusegress_policiesegress_tonew)
       * [`obj status.egress_policies.egress_to.operations`](#obj-statusegress_policiesegress_tooperations)
@@ -525,11 +529,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new](#fn-specspecegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj spec.egress_policies.egress_from.sources
+
+
+
+### fn spec.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj spec.egress_policies.egress_to
 
 
@@ -921,11 +950,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new](#fn-statusstatusegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj status.egress_policies.egress_from.sources
+
+
+
+### fn status.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj status.egress_policies.egress_to
 
 
diff --git a/docs/4.x/access_context_manager_service_perimeter_egress_policy.md b/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
index b77be377..ab94bad1 100644
--- a/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
+++ b/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
@@ -24,6 +24,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj egress_from`](#obj-egress_from)
   * [`fn new()`](#fn-egress_fromnew)
+  * [`obj egress_from.sources`](#obj-egress_fromsources)
+    * [`fn new()`](#fn-egress_fromsourcesnew)
 * [`obj egress_to`](#obj-egress_to)
   * [`fn new()`](#fn-egress_tonew)
   * [`obj egress_to.operations`](#obj-egress_tooperations)
@@ -249,11 +251,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new](#fn-egress_fromsourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj egress_from.sources
+
+
+
+### fn egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj egress_to
 
 
diff --git a/docs/4.x/access_context_manager_service_perimeters.md b/docs/4.x/access_context_manager_service_perimeters.md
index cf5750db..0412fe41 100644
--- a/docs/4.x/access_context_manager_service_perimeters.md
+++ b/docs/4.x/access_context_manager_service_perimeters.md
@@ -28,6 +28,8 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-service_perimetersspecegress_policiesnew)
       * [`obj service_perimeters.spec.egress_policies.egress_from`](#obj-service_perimetersspecegress_policiesegress_from)
         * [`fn new()`](#fn-service_perimetersspecegress_policiesegress_fromnew)
+        * [`obj service_perimeters.spec.egress_policies.egress_from.sources`](#obj-service_perimetersspecegress_policiesegress_fromsources)
+          * [`fn new()`](#fn-service_perimetersspecegress_policiesegress_fromsourcesnew)
       * [`obj service_perimeters.spec.egress_policies.egress_to`](#obj-service_perimetersspecegress_policiesegress_to)
         * [`fn new()`](#fn-service_perimetersspecegress_policiesegress_tonew)
         * [`obj service_perimeters.spec.egress_policies.egress_to.operations`](#obj-service_perimetersspecegress_policiesegress_tooperations)
@@ -54,6 +56,8 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-service_perimetersstatusegress_policiesnew)
       * [`obj service_perimeters.status.egress_policies.egress_from`](#obj-service_perimetersstatusegress_policiesegress_from)
         * [`fn new()`](#fn-service_perimetersstatusegress_policiesegress_fromnew)
+        * [`obj service_perimeters.status.egress_policies.egress_from.sources`](#obj-service_perimetersstatusegress_policiesegress_fromsources)
+          * [`fn new()`](#fn-service_perimetersstatusegress_policiesegress_fromsourcesnew)
       * [`obj service_perimeters.status.egress_policies.egress_to`](#obj-service_perimetersstatusegress_policiesegress_to)
         * [`fn new()`](#fn-service_perimetersstatusegress_policiesegress_tonew)
         * [`obj service_perimeters.status.egress_policies.egress_to.operations`](#obj-service_perimetersstatusegress_policiesegress_tooperations)
@@ -389,11 +393,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersspecegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj service_perimeters.spec.egress_policies.egress_from.sources
+
+
+
+### fn service_perimeters.spec.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj service_perimeters.spec.egress_policies.egress_to
 
 
@@ -785,11 +814,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersstatusegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj service_perimeters.status.egress_policies.egress_from.sources
+
+
+
+### fn service_perimeters.status.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj service_perimeters.status.egress_policies.egress_to
 
 
diff --git a/docs/4.x/active_directory_domain.md b/docs/4.x/active_directory_domain.md
index 7c7e947f..21f2a6ad 100644
--- a/docs/4.x/active_directory_domain.md
+++ b/docs/4.x/active_directory_domain.md
@@ -62,7 +62,10 @@ If not specified, setupadmin will be used. When `null`, the `admin` field will b
 If CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.
   - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
 https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
-  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels that can contain user-provided metadata
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
 e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -98,7 +101,10 @@ If not specified, setupadmin will be used. When `null`, the `admin` field will b
 If CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.
   - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
 https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
-  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels that can contain user-provided metadata
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
 e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/alloydb_backup.md b/docs/4.x/alloydb_backup.md
index 2a2ea6f2..24fc2034 100644
--- a/docs/4.x/alloydb_backup.md
+++ b/docs/4.x/alloydb_backup.md
@@ -15,9 +15,11 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
 * [`fn withBackupId()`](#fn-withbackupid)
 * [`fn withClusterName()`](#fn-withclustername)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEncryptionConfig()`](#fn-withencryptionconfig)
 * [`fn withEncryptionConfigMixin()`](#fn-withencryptionconfigmixin)
 * [`fn withLabels()`](#fn-withlabels)
@@ -25,6 +27,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
 * [`obj encryption_config`](#obj-encryption_config)
   * [`fn new()`](#fn-encryption_confignew)
 * [`obj timeouts`](#obj-timeouts)
@@ -59,12 +62,24 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `backup_id` (`string`): The ID of the alloydb backup.
   - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).
   - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.
+  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb backup should reside.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: ["TYPE_UNSPECIFIED", "ON_DEMAND", "AUTOMATED", "CONTINUOUS"] When `null`, the `type` field will be omitted from the resulting object.
   - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -90,12 +105,24 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `backup_id` (`string`): The ID of the alloydb backup.
   - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).
   - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.
+  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb backup should reside.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: ["TYPE_UNSPECIFIED", "ON_DEMAND", "AUTOMATED", "CONTINUOUS"] When `null`, the `type` field will be omitted from the resulting object.
   - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -103,6 +130,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_backup` resource into the root Terraform configuration.
 
 
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
 ### fn withBackupId
 
 ```ts
@@ -151,6 +194,22 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
 ### fn withEncryptionConfig
 
 ```ts
@@ -272,6 +331,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
 ## obj encryption_config
 
 
diff --git a/docs/4.x/alloydb_cluster.md b/docs/4.x/alloydb_cluster.md
index 2a95eca2..b4c75a73 100644
--- a/docs/4.x/alloydb_cluster.md
+++ b/docs/4.x/alloydb_cluster.md
@@ -15,14 +15,19 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
 * [`fn withAutomatedBackupPolicy()`](#fn-withautomatedbackuppolicy)
 * [`fn withAutomatedBackupPolicyMixin()`](#fn-withautomatedbackuppolicymixin)
 * [`fn withClusterId()`](#fn-withclusterid)
+* [`fn withClusterType()`](#fn-withclustertype)
 * [`fn withContinuousBackupConfig()`](#fn-withcontinuousbackupconfig)
 * [`fn withContinuousBackupConfigMixin()`](#fn-withcontinuousbackupconfigmixin)
+* [`fn withDatabaseVersion()`](#fn-withdatabaseversion)
+* [`fn withDeletionPolicy()`](#fn-withdeletionpolicy)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEncryptionConfig()`](#fn-withencryptionconfig)
 * [`fn withEncryptionConfigMixin()`](#fn-withencryptionconfigmixin)
+* [`fn withEtag()`](#fn-withetag)
 * [`fn withInitialUser()`](#fn-withinitialuser)
 * [`fn withInitialUserMixin()`](#fn-withinitialusermixin)
 * [`fn withLabels()`](#fn-withlabels)
@@ -35,6 +40,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRestoreBackupSourceMixin()`](#fn-withrestorebackupsourcemixin)
 * [`fn withRestoreContinuousBackupSource()`](#fn-withrestorecontinuousbackupsource)
 * [`fn withRestoreContinuousBackupSourceMixin()`](#fn-withrestorecontinuousbackupsourcemixin)
+* [`fn withSecondaryConfig()`](#fn-withsecondaryconfig)
+* [`fn withSecondaryConfigMixin()`](#fn-withsecondaryconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj automated_backup_policy`](#obj-automated_backup_policy)
@@ -63,6 +70,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-restore_backup_sourcenew)
 * [`obj restore_continuous_backup_source`](#obj-restore_continuous_backup_source)
   * [`fn new()`](#fn-restore_continuous_backup_sourcenew)
+* [`obj secondary_config`](#obj-secondary_config)
+  * [`fn new()`](#fn-secondary_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -95,9 +104,24 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster_id` (`string`): The ID of the alloydb cluster.
+  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: "PRIMARY" Possible values: ["PRIMARY", "SECONDARY"] When `null`, the `cluster_type` field will be omitted from the resulting object.
+  - `database_version` (`string`): The database engine major version. This is an optional field and it's populated at the Cluster creation time. This field cannot be changed after cluster creation. When `null`, the `database_version` field will be omitted from the resulting object.
+  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.
+Deleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.
+Deleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb cluster should reside.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
 
@@ -112,6 +136,7 @@ If no policy is provided then the default policy will be used. The default polic
   - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.
   - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.
   - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.
+  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -136,9 +161,24 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster_id` (`string`): The ID of the alloydb cluster.
+  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: "PRIMARY" Possible values: ["PRIMARY", "SECONDARY"] When `null`, the `cluster_type` field will be omitted from the resulting object.
+  - `database_version` (`string`): The database engine major version. This is an optional field and it's populated at the Cluster creation time. This field cannot be changed after cluster creation. When `null`, the `database_version` field will be omitted from the resulting object.
+  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.
+Deleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.
+Deleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb cluster should reside.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
 
@@ -153,12 +193,29 @@ If no policy is provided then the default policy will be used. The default polic
   - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.
   - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.
   - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.
+  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_cluster` resource into the root Terraform configuration.
 
 
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
 ### fn withAutomatedBackupPolicy
 
 ```ts
@@ -212,6 +269,22 @@ Terraform resource block to set or update the cluster_id field.
   - `value` (`string`): The value to set for the `cluster_id` field.
 
 
+### fn withClusterType
+
+```ts
+withClusterType()
+```
+
+`google.string.withClusterType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster_type` field.
+
+
 ### fn withContinuousBackupConfig
 
 ```ts
@@ -249,6 +322,38 @@ function.
   - `value` (`list[obj]`): The value to set for the `continuous_backup_config` field.
 
 
+### fn withDatabaseVersion
+
+```ts
+withDatabaseVersion()
+```
+
+`google.string.withDatabaseVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the database_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `database_version` field.
+
+
+### fn withDeletionPolicy
+
+```ts
+withDeletionPolicy()
+```
+
+`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the deletion_policy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `deletion_policy` field.
+
+
 ### fn withDisplayName
 
 ```ts
@@ -302,6 +407,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `encryption_config` field.
 
 
+### fn withEtag
+
+```ts
+withEtag()
+```
+
+`google.string.withEtag` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the etag field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `etag` field.
+
+
 ### fn withInitialUser
 
 ```ts
@@ -514,6 +635,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `restore_continuous_backup_source` field.
 
 
+### fn withSecondaryConfig
+
+```ts
+withSecondaryConfig()
+```
+
+`google.list[obj].withSecondaryConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the secondary_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSecondaryConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `secondary_config` field.
+
+
+### fn withSecondaryConfigMixin
+
+```ts
+withSecondaryConfigMixin()
+```
+
+`google.list[obj].withSecondaryConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the secondary_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSecondaryConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `secondary_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -874,6 +1032,30 @@ Terraform sub block.
   - An attribute object that represents the `restore_continuous_backup_source` sub block.
 
 
+## obj secondary_config
+
+
+
+### fn secondary_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_cluster.secondary_config.new` constructs a new object with attributes and blocks configured for the `secondary_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `primary_cluster_name` (`string`): Name of the primary cluster must be in the format
+'projects/{project}/locations/{location}/clusters/{cluster_id}'
+
+**Returns**:
+  - An attribute object that represents the `secondary_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/alloydb_instance.md b/docs/4.x/alloydb_instance.md
index 7dcca7c6..a5faa829 100644
--- a/docs/4.x/alloydb_instance.md
+++ b/docs/4.x/alloydb_instance.md
@@ -17,6 +17,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withAnnotations()`](#fn-withannotations)
 * [`fn withAvailabilityType()`](#fn-withavailabilitytype)
+* [`fn withClientConnectionConfig()`](#fn-withclientconnectionconfig)
+* [`fn withClientConnectionConfigMixin()`](#fn-withclientconnectionconfigmixin)
 * [`fn withCluster()`](#fn-withcluster)
 * [`fn withDatabaseFlags()`](#fn-withdatabaseflags)
 * [`fn withDisplayName()`](#fn-withdisplayname)
@@ -26,12 +28,20 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withMachineConfig()`](#fn-withmachineconfig)
 * [`fn withMachineConfigMixin()`](#fn-withmachineconfigmixin)
+* [`fn withQueryInsightsConfig()`](#fn-withqueryinsightsconfig)
+* [`fn withQueryInsightsConfigMixin()`](#fn-withqueryinsightsconfigmixin)
 * [`fn withReadPoolConfig()`](#fn-withreadpoolconfig)
 * [`fn withReadPoolConfigMixin()`](#fn-withreadpoolconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj client_connection_config`](#obj-client_connection_config)
+  * [`fn new()`](#fn-client_connection_confignew)
+  * [`obj client_connection_config.ssl_config`](#obj-client_connection_configssl_config)
+    * [`fn new()`](#fn-client_connection_configssl_confignew)
 * [`obj machine_config`](#obj-machine_config)
   * [`fn new()`](#fn-machine_confignew)
+* [`obj query_insights_config`](#obj-query_insights_config)
+  * [`fn new()`](#fn-query_insights_confignew)
 * [`obj read_pool_config`](#obj-read_pool_config)
   * [`fn new()`](#fn-read_pool_confignew)
 * [`obj timeouts`](#obj-timeouts)
@@ -66,7 +76,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
 Note that primary and read instances can have different availability types.
 Only READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.
@@ -79,9 +92,20 @@ can have regional availability (nodes are present in 2 or more zones in a region
   - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.
   - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.
   - `instance_id` (`string`): The ID of the alloydb instance.
-  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the 'depends_on' meta-data attribute. Possible values: ["PRIMARY", "READ_POOL"]
-  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `instance_type` (`string`): The type of the instance.
+If the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the 'depends_on' meta-data attribute.
+If the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.
+Example: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}
+If the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.
+Use deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.
+Users can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]
+  - `labels` (`obj`): User-defined labels for the alloydb instance.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.
   - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.
+  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.
   - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -107,7 +131,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
 Note that primary and read instances can have different availability types.
 Only READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.
@@ -120,9 +147,20 @@ can have regional availability (nodes are present in 2 or more zones in a region
   - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.
   - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.
   - `instance_id` (`string`): The ID of the alloydb instance.
-  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the 'depends_on' meta-data attribute. Possible values: ["PRIMARY", "READ_POOL"]
-  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `instance_type` (`string`): The type of the instance.
+If the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the 'depends_on' meta-data attribute.
+If the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.
+Example: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}
+If the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.
+Use deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.
+Users can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]
+  - `labels` (`obj`): User-defined labels for the alloydb instance.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.
   - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.
+  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.
   - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -162,6 +200,43 @@ Terraform resource block to set or update the availability_type field.
   - `value` (`string`): The value to set for the `availability_type` field.
 
 
+### fn withClientConnectionConfig
+
+```ts
+withClientConnectionConfig()
+```
+
+`google.list[obj].withClientConnectionConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the client_connection_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withClientConnectionConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.
+
+
+### fn withClientConnectionConfigMixin
+
+```ts
+withClientConnectionConfigMixin()
+```
+
+`google.list[obj].withClientConnectionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the client_connection_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withClientConnectionConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.
+
+
 ### fn withCluster
 
 ```ts
@@ -311,6 +386,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `machine_config` field.
 
 
+### fn withQueryInsightsConfig
+
+```ts
+withQueryInsightsConfig()
+```
+
+`google.list[obj].withQueryInsightsConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the query_insights_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withQueryInsightsConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.
+
+
+### fn withQueryInsightsConfigMixin
+
+```ts
+withQueryInsightsConfigMixin()
+```
+
+`google.list[obj].withQueryInsightsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the query_insights_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withQueryInsightsConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.
+
+
 ### fn withReadPoolConfig
 
 ```ts
@@ -384,6 +496,53 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj client_connection_config
+
+
+
+### fn client_connection_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_instance.client_connection_config.new` constructs a new object with attributes and blocks configured for the `client_connection_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `require_connectors` (`bool`): Configuration to enforce connectors only (ex: AuthProxy) connections to the database. When `null`, the `require_connectors` field will be omitted from the resulting object.
+  - `ssl_config` (`list[obj]`): SSL config option for this instance. When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.ssl_config.new](#fn-client_connection_configssl_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `client_connection_config` sub block.
+
+
+## obj client_connection_config.ssl_config
+
+
+
+### fn client_connection_config.ssl_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_instance.client_connection_config.ssl_config.new` constructs a new object with attributes and blocks configured for the `ssl_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ssl_mode` (`string`): SSL mode. Specifies client-server SSL/TLS connection behavior. Possible values: ["ENCRYPTED_ONLY", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"] When `null`, the `ssl_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ssl_config` sub block.
+
+
 ## obj machine_config
 
 
@@ -407,6 +566,32 @@ Terraform sub block.
   - An attribute object that represents the `machine_config` sub block.
 
 
+## obj query_insights_config
+
+
+
+### fn query_insights_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_instance.query_insights_config.new` constructs a new object with attributes and blocks configured for the `query_insights_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `query_plans_per_minute` (`number`): Number of query execution plans captured by Insights per minute for all queries combined. The default value is 5. Any integer between 0 and 20 is considered valid. When `null`, the `query_plans_per_minute` field will be omitted from the resulting object.
+  - `query_string_length` (`number`): Query string length. The default value is 1024. Any integer between 256 and 4500 is considered valid. When `null`, the `query_string_length` field will be omitted from the resulting object.
+  - `record_application_tags` (`bool`): Record application tags for an instance. This flag is turned "on" by default. When `null`, the `record_application_tags` field will be omitted from the resulting object.
+  - `record_client_address` (`bool`): Record client address for an instance. Client address is PII information. This flag is turned "on" by default. When `null`, the `record_client_address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `query_insights_config` sub block.
+
+
 ## obj read_pool_config
 
 
diff --git a/docs/4.x/alloydb_user.md b/docs/4.x/alloydb_user.md
new file mode 100644
index 00000000..2bf21287
--- /dev/null
+++ b/docs/4.x/alloydb_user.md
@@ -0,0 +1,237 @@
+---
+permalink: /alloydb_user/
+---
+
+# alloydb_user
+
+`alloydb_user` represents the `google_alloydb_user` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCluster()`](#fn-withcluster)
+* [`fn withDatabaseRoles()`](#fn-withdatabaseroles)
+* [`fn withPassword()`](#fn-withpassword)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUserId()`](#fn-withuserid)
+* [`fn withUserType()`](#fn-withusertype)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.alloydb_user.new` injects a new `google_alloydb_user` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.alloydb_user.new('some_id')
+
+You can get the reference to the `id` field of the created `google.alloydb_user` using the reference:
+
+    $._ref.google_alloydb_user.some_id.get('id')
+
+This is the same as directly entering `"${ google_alloydb_user.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format
+'projects/{project}/locations/{location}/clusters/{cluster_id}'
+  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.
+  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.
+  - `user_id` (`string`): The database role name of the user.
+  - `user_type` (`string`): The type of this user. Possible values: ["ALLOYDB_BUILT_IN", "ALLOYDB_IAM_USER"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.alloydb_user.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_user`
+Terraform resource.
+
+Unlike [google.alloydb_user.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format
+'projects/{project}/locations/{location}/clusters/{cluster_id}'
+  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.
+  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.
+  - `user_id` (`string`): The database role name of the user.
+  - `user_type` (`string`): The type of this user. Possible values: ["ALLOYDB_BUILT_IN", "ALLOYDB_IAM_USER"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_user` resource into the root Terraform configuration.
+
+
+### fn withCluster
+
+```ts
+withCluster()
+```
+
+`google.string.withCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster` field.
+
+
+### fn withDatabaseRoles
+
+```ts
+withDatabaseRoles()
+```
+
+`google.list.withDatabaseRoles` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the database_roles field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `database_roles` field.
+
+
+### fn withPassword
+
+```ts
+withPassword()
+```
+
+`google.string.withPassword` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the password field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `password` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUserId
+
+```ts
+withUserId()
+```
+
+`google.string.withUserId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the user_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `user_id` field.
+
+
+### fn withUserType
+
+```ts
+withUserType()
+```
+
+`google.string.withUserType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the user_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `user_type` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_user.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/apigee_environment.md b/docs/4.x/apigee_environment.md
index b56ba5e3..0380cdba 100644
--- a/docs/4.x/apigee_environment.md
+++ b/docs/4.x/apigee_environment.md
@@ -25,6 +25,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withOrgId()`](#fn-withorgid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
 * [`obj node_config`](#obj-node_config)
   * [`fn new()`](#fn-node_confignew)
 * [`obj timeouts`](#obj-timeouts)
@@ -73,6 +74,10 @@ Creating, updating, or deleting target servers. Possible values: ["DEPLOYMEN
   - `name` (`string`): The resource ID of the environment.
   - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,
 in the format 'organizations/{{org_name}}'.
+  - `type` (`string`): Types that can be selected for an Environment. Each of the types are
+limited by capability and capacity. Refer to Apigee's public documentation
+to understand about each of these types in details.
+An Apigee org can support heterogeneous Environments. Possible values: ["ENVIRONMENT_TYPE_UNSPECIFIED", "BASE", "INTERMEDIATE", "COMPREHENSIVE"] When `null`, the `type` field will be omitted from the resulting object.
   - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -112,6 +117,10 @@ Creating, updating, or deleting target servers. Possible values: ["DEPLOYMEN
   - `name` (`string`): The resource ID of the environment.
   - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,
 in the format 'organizations/{{org_name}}'.
+  - `type` (`string`): Types that can be selected for an Environment. Each of the types are
+limited by capability and capacity. Refer to Apigee's public documentation
+to understand about each of these types in details.
+An Apigee org can support heterogeneous Environments. Possible values: ["ENVIRONMENT_TYPE_UNSPECIFIED", "BASE", "INTERMEDIATE", "COMPREHENSIVE"] When `null`, the `type` field will be omitted from the resulting object.
   - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -288,6 +297,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
 ## obj node_config
 
 
diff --git a/docs/4.x/artifact_registry_repository.md b/docs/4.x/artifact_registry_repository.md
index 11f0b72c..caaf24e5 100644
--- a/docs/4.x/artifact_registry_repository.md
+++ b/docs/4.x/artifact_registry_repository.md
@@ -15,6 +15,9 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCleanupPolicies()`](#fn-withcleanuppolicies)
+* [`fn withCleanupPoliciesMixin()`](#fn-withcleanuppoliciesmixin)
+* [`fn withCleanupPolicyDryRun()`](#fn-withcleanuppolicydryrun)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDockerConfig()`](#fn-withdockerconfig)
 * [`fn withDockerConfigMixin()`](#fn-withdockerconfigmixin)
@@ -33,12 +36,22 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withVirtualRepositoryConfig()`](#fn-withvirtualrepositoryconfig)
 * [`fn withVirtualRepositoryConfigMixin()`](#fn-withvirtualrepositoryconfigmixin)
+* [`obj cleanup_policies`](#obj-cleanup_policies)
+  * [`fn new()`](#fn-cleanup_policiesnew)
+  * [`obj cleanup_policies.condition`](#obj-cleanup_policiescondition)
+    * [`fn new()`](#fn-cleanup_policiesconditionnew)
+  * [`obj cleanup_policies.most_recent_versions`](#obj-cleanup_policiesmost_recent_versions)
+    * [`fn new()`](#fn-cleanup_policiesmost_recent_versionsnew)
 * [`obj docker_config`](#obj-docker_config)
   * [`fn new()`](#fn-docker_confignew)
 * [`obj maven_config`](#obj-maven_config)
   * [`fn new()`](#fn-maven_confignew)
 * [`obj remote_repository_config`](#obj-remote_repository_config)
   * [`fn new()`](#fn-remote_repository_confignew)
+  * [`obj remote_repository_config.apt_repository`](#obj-remote_repository_configapt_repository)
+    * [`fn new()`](#fn-remote_repository_configapt_repositorynew)
+    * [`obj remote_repository_config.apt_repository.public_repository`](#obj-remote_repository_configapt_repositorypublic_repository)
+      * [`fn new()`](#fn-remote_repository_configapt_repositorypublic_repositorynew)
   * [`obj remote_repository_config.docker_repository`](#obj-remote_repository_configdocker_repository)
     * [`fn new()`](#fn-remote_repository_configdocker_repositorynew)
   * [`obj remote_repository_config.maven_repository`](#obj-remote_repository_configmaven_repository)
@@ -47,6 +60,14 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-remote_repository_confignpm_repositorynew)
   * [`obj remote_repository_config.python_repository`](#obj-remote_repository_configpython_repository)
     * [`fn new()`](#fn-remote_repository_configpython_repositorynew)
+  * [`obj remote_repository_config.upstream_credentials`](#obj-remote_repository_configupstream_credentials)
+    * [`fn new()`](#fn-remote_repository_configupstream_credentialsnew)
+    * [`obj remote_repository_config.upstream_credentials.username_password_credentials`](#obj-remote_repository_configupstream_credentialsusername_password_credentials)
+      * [`fn new()`](#fn-remote_repository_configupstream_credentialsusername_password_credentialsnew)
+  * [`obj remote_repository_config.yum_repository`](#obj-remote_repository_configyum_repository)
+    * [`fn new()`](#fn-remote_repository_configyum_repositorynew)
+    * [`obj remote_repository_config.yum_repository.public_repository`](#obj-remote_repository_configyum_repositorypublic_repository)
+      * [`fn new()`](#fn-remote_repository_configyum_repositorypublic_repositorynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 * [`obj virtual_repository_config`](#obj-virtual_repository_config)
@@ -83,6 +104,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `cleanup_policy_dry_run` (`bool`): If true, the cleanup pipeline is prevented from deleting versions in this
+repository. When `null`, the `cleanup_policy_dry_run` field will be omitted from the resulting object.
   - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.
   - `format` (`string`): The format of packages that are stored in the repository. Supported formats
 can be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).
@@ -96,12 +119,20 @@ This value may not be changed after the Repository has been created. When `null`
 This field may contain up to 64 entries. Label keys and values may be no
 longer than 63 characters. Label keys must begin with a lowercase letter
 and may only contain lowercase letters, numeric characters, underscores,
-and dashes. When `null`, the `labels` field will be omitted from the resulting object.
+and dashes.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.
   - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `repository_id` (`string`): The last part of the repository name, for example:
 "repo1"
+  - `cleanup_policies` (`list[obj]`): Cleanup policies for this repository. Cleanup policies indicate when
+certain package versions can be automatically deleted.
+Map keys are policy IDs supplied by users during policy creation. They must
+unique within a repository and be under 128 characters in length. When `null`, the `cleanup_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.new](#fn-cleanup_policiesnew) constructor.
   - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.
   - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.
 Provides additional configuration details for repositories of the maven
@@ -132,6 +163,8 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `cleanup_policy_dry_run` (`bool`): If true, the cleanup pipeline is prevented from deleting versions in this
+repository. When `null`, the `cleanup_policy_dry_run` field will be omitted from the resulting object.
   - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.
   - `format` (`string`): The format of packages that are stored in the repository. Supported formats
 can be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).
@@ -145,12 +178,20 @@ This value may not be changed after the Repository has been created. When `null`
 This field may contain up to 64 entries. Label keys and values may be no
 longer than 63 characters. Label keys must begin with a lowercase letter
 and may only contain lowercase letters, numeric characters, underscores,
-and dashes. When `null`, the `labels` field will be omitted from the resulting object.
+and dashes.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.
   - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `repository_id` (`string`): The last part of the repository name, for example:
 "repo1"
+  - `cleanup_policies` (`list[obj]`): Cleanup policies for this repository. Cleanup policies indicate when
+certain package versions can be automatically deleted.
+Map keys are policy IDs supplied by users during policy creation. They must
+unique within a repository and be under 128 characters in length. When `null`, the `cleanup_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.new](#fn-cleanup_policiesnew) constructor.
   - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.
   - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.
 Provides additional configuration details for repositories of the maven
@@ -163,6 +204,59 @@ format type. When `null`, the `maven_config` sub block will be omitted from the
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `artifact_registry_repository` resource into the root Terraform configuration.
 
 
+### fn withCleanupPolicies
+
+```ts
+withCleanupPolicies()
+```
+
+`google.list[obj].withCleanupPolicies` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cleanup_policies field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCleanupPoliciesMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cleanup_policies` field.
+
+
+### fn withCleanupPoliciesMixin
+
+```ts
+withCleanupPoliciesMixin()
+```
+
+`google.list[obj].withCleanupPoliciesMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cleanup_policies field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCleanupPolicies](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cleanup_policies` field.
+
+
+### fn withCleanupPolicyDryRun
+
+```ts
+withCleanupPolicyDryRun()
+```
+
+`google.bool.withCleanupPolicyDryRun` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the cleanup_policy_dry_run field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `cleanup_policy_dry_run` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -475,6 +569,84 @@ function.
   - `value` (`list[obj]`): The value to set for the `virtual_repository_config` field.
 
 
+## obj cleanup_policies
+
+
+
+### fn cleanup_policies.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.cleanup_policies.new` constructs a new object with attributes and blocks configured for the `cleanup_policies`
+Terraform sub block.
+
+
+
+**Args**:
+  - `action` (`string`): Policy action. Possible values: ["DELETE", "KEEP"] When `null`, the `action` field will be omitted from the resulting object.
+  - `condition` (`list[obj]`): Policy condition for matching versions. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.condition.new](#fn-cleanup_policiesconditionnew) constructor.
+  - `most_recent_versions` (`list[obj]`): Policy condition for retaining a minimum number of versions. May only be
+specified with a Keep action. When `null`, the `most_recent_versions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.cleanup_policies.most_recent_versions.new](#fn-cleanup_policiesmost_recent_versionsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `cleanup_policies` sub block.
+
+
+## obj cleanup_policies.condition
+
+
+
+### fn cleanup_policies.condition.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.cleanup_policies.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `newer_than` (`string`): Match versions newer than a duration. When `null`, the `newer_than` field will be omitted from the resulting object.
+  - `older_than` (`string`): Match versions older than a duration. When `null`, the `older_than` field will be omitted from the resulting object.
+  - `package_name_prefixes` (`list`): Match versions by package prefix. Applied on any prefix match. When `null`, the `package_name_prefixes` field will be omitted from the resulting object.
+  - `tag_prefixes` (`list`): Match versions by tag prefix. Applied on any prefix match. When `null`, the `tag_prefixes` field will be omitted from the resulting object.
+  - `tag_state` (`string`): Match versions by tag status. Default value: "ANY" Possible values: ["TAGGED", "UNTAGGED", "ANY"] When `null`, the `tag_state` field will be omitted from the resulting object.
+  - `version_name_prefixes` (`list`): Match versions by version name prefix. Applied on any prefix match. When `null`, the `version_name_prefixes` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
+
+
+## obj cleanup_policies.most_recent_versions
+
+
+
+### fn cleanup_policies.most_recent_versions.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.cleanup_policies.most_recent_versions.new` constructs a new object with attributes and blocks configured for the `most_recent_versions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `keep_count` (`number`): Minimum number of versions to keep. When `null`, the `keep_count` field will be omitted from the resulting object.
+  - `package_name_prefixes` (`list`): Match versions by package prefix. Applied on any prefix match. When `null`, the `package_name_prefixes` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `most_recent_versions` sub block.
+
+
 ## obj docker_config
 
 
@@ -541,15 +713,65 @@ Terraform sub block.
 
 **Args**:
   - `description` (`string`): The description of the remote source. When `null`, the `description` field will be omitted from the resulting object.
+  - `apt_repository` (`list[obj]`): Specific settings for an Apt remote repository. When `null`, the `apt_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.new](#fn-remote_repository_configapt_repositorynew) constructor.
   - `docker_repository` (`list[obj]`): Specific settings for a Docker remote repository. When `null`, the `docker_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.docker_repository.new](#fn-remote_repository_configdocker_repositorynew) constructor.
   - `maven_repository` (`list[obj]`): Specific settings for a Maven remote repository. When `null`, the `maven_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.maven_repository.new](#fn-remote_repository_configmaven_repositorynew) constructor.
   - `npm_repository` (`list[obj]`): Specific settings for an Npm remote repository. When `null`, the `npm_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.npm_repository.new](#fn-remote_repository_confignpm_repositorynew) constructor.
   - `python_repository` (`list[obj]`): Specific settings for a Python remote repository. When `null`, the `python_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.python_repository.new](#fn-remote_repository_configpython_repositorynew) constructor.
+  - `upstream_credentials` (`list[obj]`): The credentials used to access the remote repository. When `null`, the `upstream_credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.upstream_credentials.new](#fn-remote_repository_configupstream_credentialsnew) constructor.
+  - `yum_repository` (`list[obj]`): Specific settings for an Yum remote repository. When `null`, the `yum_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.new](#fn-remote_repository_configyum_repositorynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `remote_repository_config` sub block.
 
 
+## obj remote_repository_config.apt_repository
+
+
+
+### fn remote_repository_config.apt_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.apt_repository.new` constructs a new object with attributes and blocks configured for the `apt_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `public_repository` (`list[obj]`): One of the publicly available Apt repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `apt_repository` sub block.
+
+
+## obj remote_repository_config.apt_repository.public_repository
+
+
+
+### fn remote_repository_config.apt_repository.public_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `repository_base` (`string`): A common public repository base for Apt, e.g. '"debian/dists/buster"' Possible values: ["DEBIAN", "UBUNTU"]
+  - `repository_path` (`string`): Specific repository from the base.
+
+**Returns**:
+  - An attribute object that represents the `public_repository` sub block.
+
+
 ## obj remote_repository_config.docker_repository
 
 
@@ -642,6 +864,102 @@ Terraform sub block.
   - An attribute object that represents the `python_repository` sub block.
 
 
+## obj remote_repository_config.upstream_credentials
+
+
+
+### fn remote_repository_config.upstream_credentials.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.upstream_credentials.new` constructs a new object with attributes and blocks configured for the `upstream_credentials`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username_password_credentials` (`list[obj]`): Use username and password to access the remote repository. When `null`, the `username_password_credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.upstream_credentials.username_password_credentials.new](#fn-remote_repository_configremote_repository_configusername_password_credentialsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `upstream_credentials` sub block.
+
+
+## obj remote_repository_config.upstream_credentials.username_password_credentials
+
+
+
+### fn remote_repository_config.upstream_credentials.username_password_credentials.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.upstream_credentials.username_password_credentials.new` constructs a new object with attributes and blocks configured for the `username_password_credentials`
+Terraform sub block.
+
+
+
+**Args**:
+  - `password_secret_version` (`string`): The Secret Manager key version that holds the password to access the
+remote repository. Must be in the format of
+'projects/{project}/secrets/{secret}/versions/{version}'. When `null`, the `password_secret_version` field will be omitted from the resulting object.
+  - `username` (`string`): The username to access the remote repository. When `null`, the `username` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `username_password_credentials` sub block.
+
+
+## obj remote_repository_config.yum_repository
+
+
+
+### fn remote_repository_config.yum_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.yum_repository.new` constructs a new object with attributes and blocks configured for the `yum_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `public_repository` (`list[obj]`): One of the publicly available Yum repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `yum_repository` sub block.
+
+
+## obj remote_repository_config.yum_repository.public_repository
+
+
+
+### fn remote_repository_config.yum_repository.public_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `repository_base` (`string`): A common public repository base for Yum. Possible values: ["CENTOS", "CENTOS_DEBUG", "CENTOS_VAULT", "CENTOS_STREAM", "ROCKY", "EPEL"]
+  - `repository_path` (`string`): Specific repository from the base, e.g. '"centos/8-stream/BaseOS/x86_64/os"'
+
+**Returns**:
+  - An attribute object that represents the `public_repository` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/assured_workloads_workload.md b/docs/4.x/assured_workloads_workload.md
index 8c992455..e04d38c5 100644
--- a/docs/4.x/assured_workloads_workload.md
+++ b/docs/4.x/assured_workloads_workload.md
@@ -18,18 +18,25 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withBillingAccount()`](#fn-withbillingaccount)
 * [`fn withComplianceRegime()`](#fn-withcomplianceregime)
 * [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEnableSovereignControls()`](#fn-withenablesovereigncontrols)
 * [`fn withKmsSettings()`](#fn-withkmssettings)
 * [`fn withKmsSettingsMixin()`](#fn-withkmssettingsmixin)
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withOrganization()`](#fn-withorganization)
+* [`fn withPartner()`](#fn-withpartner)
+* [`fn withPartnerPermissions()`](#fn-withpartnerpermissions)
+* [`fn withPartnerPermissionsMixin()`](#fn-withpartnerpermissionsmixin)
 * [`fn withProvisionedResourcesParent()`](#fn-withprovisionedresourcesparent)
 * [`fn withResourceSettings()`](#fn-withresourcesettings)
 * [`fn withResourceSettingsMixin()`](#fn-withresourcesettingsmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withViolationNotificationsEnabled()`](#fn-withviolationnotificationsenabled)
 * [`obj kms_settings`](#obj-kms_settings)
   * [`fn new()`](#fn-kms_settingsnew)
+* [`obj partner_permissions`](#obj-partner_permissions)
+  * [`fn new()`](#fn-partner_permissionsnew)
 * [`obj resource_settings`](#obj-resource_settings)
   * [`fn new()`](#fn-resource_settingsnew)
 * [`obj timeouts`](#obj-timeouts)
@@ -64,14 +71,21 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.
-  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS
+  - `billing_account` (`string`): Optional. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, `billingAccounts/012345-567890-ABCDEF`. When `null`, the `billing_account` field will be omitted from the resulting object.
+  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, HITRUST, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS, ISR_REGIONS, ISR_REGIONS_AND_SUPPORT, CA_PROTECTED_B, IL5, IL2, JP_REGIONS_AND_SUPPORT
   - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
-  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.
+  - `enable_sovereign_controls` (`bool`): Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers. When `null`, the `enable_sovereign_controls` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels applied to the workload.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `organization` (`string`): The organization for the resource
-  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.
-  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.
+  - `partner` (`string`): Optional. Partner regime associated with this workload. Possible values: PARTNER_UNSPECIFIED, LOCAL_CONTROLS_BY_S3NS, SOVEREIGN_CONTROLS_BY_T_SYSTEMS, SOVEREIGN_CONTROLS_BY_SIA_MINSAIT, SOVEREIGN_CONTROLS_BY_PSN When `null`, the `partner` field will be omitted from the resulting object.
+  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.
+  - `violation_notifications_enabled` (`bool`): Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload. When `null`, the `violation_notifications_enabled` field will be omitted from the resulting object.
+  - `kms_settings` (`list[obj]`): **DEPRECATED** Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.
+  - `partner_permissions` (`list[obj]`): Optional. Permissions granted to the AW Partner SA account for the customer workload When `null`, the `partner_permissions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.partner_permissions.new](#fn-partner_permissionsnew) constructor.
   - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -97,14 +111,21 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.
-  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS
+  - `billing_account` (`string`): Optional. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, `billingAccounts/012345-567890-ABCDEF`. When `null`, the `billing_account` field will be omitted from the resulting object.
+  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, HITRUST, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS, ISR_REGIONS, ISR_REGIONS_AND_SUPPORT, CA_PROTECTED_B, IL5, IL2, JP_REGIONS_AND_SUPPORT
   - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
-  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.
+  - `enable_sovereign_controls` (`bool`): Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers. When `null`, the `enable_sovereign_controls` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels applied to the workload.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `organization` (`string`): The organization for the resource
-  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.
-  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.
+  - `partner` (`string`): Optional. Partner regime associated with this workload. Possible values: PARTNER_UNSPECIFIED, LOCAL_CONTROLS_BY_S3NS, SOVEREIGN_CONTROLS_BY_T_SYSTEMS, SOVEREIGN_CONTROLS_BY_SIA_MINSAIT, SOVEREIGN_CONTROLS_BY_PSN When `null`, the `partner` field will be omitted from the resulting object.
+  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.
+  - `violation_notifications_enabled` (`bool`): Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload. When `null`, the `violation_notifications_enabled` field will be omitted from the resulting object.
+  - `kms_settings` (`list[obj]`): **DEPRECATED** Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.
+  - `partner_permissions` (`list[obj]`): Optional. Permissions granted to the AW Partner SA account for the customer workload When `null`, the `partner_permissions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.partner_permissions.new](#fn-partner_permissionsnew) constructor.
   - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -160,6 +181,22 @@ Terraform resource block to set or update the display_name field.
   - `value` (`string`): The value to set for the `display_name` field.
 
 
+### fn withEnableSovereignControls
+
+```ts
+withEnableSovereignControls()
+```
+
+`google.bool.withEnableSovereignControls` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_sovereign_controls field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_sovereign_controls` field.
+
+
 ### fn withKmsSettings
 
 ```ts
@@ -245,6 +282,59 @@ Terraform resource block to set or update the organization field.
   - `value` (`string`): The value to set for the `organization` field.
 
 
+### fn withPartner
+
+```ts
+withPartner()
+```
+
+`google.string.withPartner` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the partner field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `partner` field.
+
+
+### fn withPartnerPermissions
+
+```ts
+withPartnerPermissions()
+```
+
+`google.list[obj].withPartnerPermissions` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the partner_permissions field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPartnerPermissionsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `partner_permissions` field.
+
+
+### fn withPartnerPermissionsMixin
+
+```ts
+withPartnerPermissionsMixin()
+```
+
+`google.list[obj].withPartnerPermissionsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the partner_permissions field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPartnerPermissions](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `partner_permissions` field.
+
+
 ### fn withProvisionedResourcesParent
 
 ```ts
@@ -334,6 +424,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withViolationNotificationsEnabled
+
+```ts
+withViolationNotificationsEnabled()
+```
+
+`google.bool.withViolationNotificationsEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the violation_notifications_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `violation_notifications_enabled` field.
+
+
 ## obj kms_settings
 
 
@@ -358,6 +464,31 @@ Terraform sub block.
   - An attribute object that represents the `kms_settings` sub block.
 
 
+## obj partner_permissions
+
+
+
+### fn partner_permissions.new
+
+```ts
+new()
+```
+
+
+`google.assured_workloads_workload.partner_permissions.new` constructs a new object with attributes and blocks configured for the `partner_permissions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `assured_workloads_monitoring` (`bool`): Optional. Allow partner to view violation alerts. When `null`, the `assured_workloads_monitoring` field will be omitted from the resulting object.
+  - `data_logs_viewer` (`bool`): Allow the partner to view inspectability logs and monitoring violations. When `null`, the `data_logs_viewer` field will be omitted from the resulting object.
+  - `service_access_approver` (`bool`): Optional. Allow partner to view access approval logs. When `null`, the `service_access_approver` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `partner_permissions` sub block.
+
+
 ## obj resource_settings
 
 
@@ -375,7 +506,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `resource_id` (`string`): Resource identifier. For a project this represents project_number. If the project is already taken, the workload creation will fail. When `null`, the `resource_id` field will be omitted from the resulting object.
+  - `display_name` (`string`): User-assigned resource display name. If not empty it will be used to create a resource with the specified name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `resource_id` (`string`): Resource identifier. For a project this represents projectId. If the project is already taken, the workload creation will fail. For KeyRing, this represents the keyring_id. For a folder, don't set this value as folder_id is assigned by Google. When `null`, the `resource_id` field will be omitted from the resulting object.
   - `resource_type` (`string`): Indicates the type of resource. This field should be specified to correspond the id to the right project type (CONSUMER_PROJECT or ENCRYPTION_KEYS_PROJECT) Possible values: RESOURCE_TYPE_UNSPECIFIED, CONSUMER_PROJECT, ENCRYPTION_KEYS_PROJECT, KEYRING, CONSUMER_FOLDER When `null`, the `resource_type` field will be omitted from the resulting object.
 
 **Returns**:
diff --git a/docs/4.x/beyondcorp_app_connection.md b/docs/4.x/beyondcorp_app_connection.md
index 422d8851..b4412ae6 100644
--- a/docs/4.x/beyondcorp_app_connection.md
+++ b/docs/4.x/beyondcorp_app_connection.md
@@ -66,7 +66,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnection.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.
@@ -101,7 +105,11 @@ injecting into a complete block.
 **Args**:
   - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnection.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/beyondcorp_app_connector.md b/docs/4.x/beyondcorp_app_connector.md
index b3635f1c..80b23d94 100644
--- a/docs/4.x/beyondcorp_app_connector.md
+++ b/docs/4.x/beyondcorp_app_connector.md
@@ -61,7 +61,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnector.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.
@@ -91,7 +95,11 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnector.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/beyondcorp_app_gateway.md b/docs/4.x/beyondcorp_app_gateway.md
index c40d79ab..5eb648ef 100644
--- a/docs/4.x/beyondcorp_app_gateway.md
+++ b/docs/4.x/beyondcorp_app_gateway.md
@@ -58,7 +58,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.
   - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppGateway.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.
@@ -89,7 +93,11 @@ injecting into a complete block.
 **Args**:
   - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.
   - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppGateway.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.
@@ -267,6 +275,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/bigquery_analytics_hub_listing.md b/docs/4.x/bigquery_analytics_hub_listing.md
index 6739d488..ece35a3d 100644
--- a/docs/4.x/bigquery_analytics_hub_listing.md
+++ b/docs/4.x/bigquery_analytics_hub_listing.md
@@ -32,6 +32,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withPublisher()`](#fn-withpublisher)
 * [`fn withPublisherMixin()`](#fn-withpublishermixin)
 * [`fn withRequestAccess()`](#fn-withrequestaccess)
+* [`fn withRestrictedExportConfig()`](#fn-withrestrictedexportconfig)
+* [`fn withRestrictedExportConfigMixin()`](#fn-withrestrictedexportconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj bigquery_dataset`](#obj-bigquery_dataset)
@@ -40,6 +42,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-data_providernew)
 * [`obj publisher`](#obj-publisher)
   * [`fn new()`](#fn-publishernew)
+* [`obj restricted_export_config`](#obj-restricted_export_config)
+  * [`fn new()`](#fn-restricted_export_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -86,6 +90,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `bigquery_dataset` (`list[obj]`): Shared dataset i.e. BigQuery dataset source. When `null`, the `bigquery_dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.bigquery_dataset.new](#fn-bigquery_datasetnew) constructor.
   - `data_provider` (`list[obj]`): Details of the data provider who owns the source data. When `null`, the `data_provider` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.data_provider.new](#fn-data_providernew) constructor.
   - `publisher` (`list[obj]`): Details of the publisher who owns the listing and who can share the source data. When `null`, the `publisher` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.publisher.new](#fn-publishernew) constructor.
+  - `restricted_export_config` (`list[obj]`): If set, restricted export configuration will be propagated and enforced on the linked dataset. When `null`, the `restricted_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.restricted_export_config.new](#fn-restricted_export_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -124,6 +129,7 @@ injecting into a complete block.
   - `bigquery_dataset` (`list[obj]`): Shared dataset i.e. BigQuery dataset source. When `null`, the `bigquery_dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.bigquery_dataset.new](#fn-bigquery_datasetnew) constructor.
   - `data_provider` (`list[obj]`): Details of the data provider who owns the source data. When `null`, the `data_provider` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.data_provider.new](#fn-data_providernew) constructor.
   - `publisher` (`list[obj]`): Details of the publisher who owns the listing and who can share the source data. When `null`, the `publisher` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.publisher.new](#fn-publishernew) constructor.
+  - `restricted_export_config` (`list[obj]`): If set, restricted export configuration will be propagated and enforced on the linked dataset. When `null`, the `restricted_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.restricted_export_config.new](#fn-restricted_export_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_analytics_hub_listing.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -417,6 +423,43 @@ Terraform resource block to set or update the request_access field.
   - `value` (`string`): The value to set for the `request_access` field.
 
 
+### fn withRestrictedExportConfig
+
+```ts
+withRestrictedExportConfig()
+```
+
+`google.list[obj].withRestrictedExportConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the restricted_export_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withRestrictedExportConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `restricted_export_config` field.
+
+
+### fn withRestrictedExportConfigMixin
+
+```ts
+withRestrictedExportConfigMixin()
+```
+
+`google.list[obj].withRestrictedExportConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the restricted_export_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withRestrictedExportConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `restricted_export_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -524,6 +567,30 @@ Terraform sub block.
   - An attribute object that represents the `publisher` sub block.
 
 
+## obj restricted_export_config
+
+
+
+### fn restricted_export_config.new
+
+```ts
+new()
+```
+
+
+`google.bigquery_analytics_hub_listing.restricted_export_config.new` constructs a new object with attributes and blocks configured for the `restricted_export_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, enable restricted export. When `null`, the `enabled` field will be omitted from the resulting object.
+  - `restrict_query_result` (`bool`): If true, restrict export of query result derived from restricted linked dataset table. When `null`, the `restrict_query_result` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `restricted_export_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/bigquery_capacity_commitment.md b/docs/4.x/bigquery_capacity_commitment.md
index 4c1c06c1..abffc147 100644
--- a/docs/4.x/bigquery_capacity_commitment.md
+++ b/docs/4.x/bigquery_capacity_commitment.md
@@ -67,7 +67,7 @@ or merged. When `null`, the `capacity_commitment_id` field will be omitted from
 Examples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
+  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
   - `slot_count` (`number`): Number of slots in this commitment.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -103,7 +103,7 @@ or merged. When `null`, the `capacity_commitment_id` field will be omitted from
 Examples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
+  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
   - `slot_count` (`number`): Number of slots in this commitment.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.
 
diff --git a/docs/4.x/bigquery_connection.md b/docs/4.x/bigquery_connection.md
index 795fcec7..515a5c84 100644
--- a/docs/4.x/bigquery_connection.md
+++ b/docs/4.x/bigquery_connection.md
@@ -30,6 +30,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withFriendlyName()`](#fn-withfriendlyname)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withSpark()`](#fn-withspark)
+* [`fn withSparkMixin()`](#fn-withsparkmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj aws`](#obj-aws)
@@ -46,6 +48,12 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-cloud_sqlnew)
   * [`obj cloud_sql.credential`](#obj-cloud_sqlcredential)
     * [`fn new()`](#fn-cloud_sqlcredentialnew)
+* [`obj spark`](#obj-spark)
+  * [`fn new()`](#fn-sparknew)
+  * [`obj spark.metastore_service_config`](#obj-sparkmetastore_service_config)
+    * [`fn new()`](#fn-sparkmetastore_service_confignew)
+  * [`obj spark.spark_history_server_config`](#obj-sparkspark_history_server_config)
+    * [`fn new()`](#fn-sparkspark_history_server_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -94,6 +102,7 @@ Azure allowed regions are azure-eastus2 When `null`, the `location` field will b
   - `cloud_resource` (`list[obj]`): Container for connection properties for delegation of access to GCP resources. When `null`, the `cloud_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_resource.new](#fn-cloud_resourcenew) constructor.
   - `cloud_spanner` (`list[obj]`): Connection properties specific to Cloud Spanner When `null`, the `cloud_spanner` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_spanner.new](#fn-cloud_spannernew) constructor.
   - `cloud_sql` (`list[obj]`): Connection properties specific to the Cloud SQL. When `null`, the `cloud_sql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_sql.new](#fn-cloud_sqlnew) constructor.
+  - `spark` (`list[obj]`): Container for connection properties to execute stored procedures for Apache Spark. resources. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.new](#fn-sparknew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -134,6 +143,7 @@ Azure allowed regions are azure-eastus2 When `null`, the `location` field will b
   - `cloud_resource` (`list[obj]`): Container for connection properties for delegation of access to GCP resources. When `null`, the `cloud_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_resource.new](#fn-cloud_resourcenew) constructor.
   - `cloud_spanner` (`list[obj]`): Connection properties specific to Cloud Spanner When `null`, the `cloud_spanner` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_spanner.new](#fn-cloud_spannernew) constructor.
   - `cloud_sql` (`list[obj]`): Connection properties specific to the Cloud SQL. When `null`, the `cloud_sql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.cloud_sql.new](#fn-cloud_sqlnew) constructor.
+  - `spark` (`list[obj]`): Container for connection properties to execute stored procedures for Apache Spark. resources. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.new](#fn-sparknew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -405,6 +415,43 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withSpark
+
+```ts
+withSpark()
+```
+
+`google.list[obj].withSpark` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the spark field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSparkMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `spark` field.
+
+
+### fn withSparkMixin
+
+```ts
+withSparkMixin()
+```
+
+`google.list[obj].withSparkMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the spark field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSpark](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `spark` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -548,9 +595,12 @@ Terraform sub block.
 
 
 **Args**:
-  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'
-  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner When `null`, the `use_parallelism` field will be omitted from the resulting object.
-  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. useParallelism must be set when using serverless analytics When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.
+  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'.
+  - `database_role` (`string`): Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin should have provisioned the database role with appropriate permissions, such as 'SELECT' and 'INSERT'. Other users should only use roles provided by their Cloud Spanner admins. The database role name must start with a letter, and can only contain letters, numbers, and underscores. For more details, see https://cloud.google.com/spanner/docs/fgac-about. When `null`, the `database_role` field will be omitted from the resulting object.
+  - `max_parallelism` (`number`): Allows setting max parallelism per query when executing on Spanner independent compute resources. If unspecified, default values of parallelism are chosen that are dependent on the Cloud Spanner instance configuration. 'useParallelism' and 'useDataBoost' must be set when setting max parallelism. When `null`, the `max_parallelism` field will be omitted from the resulting object.
+  - `use_data_boost` (`bool`): If set, the request will be executed via Spanner independent compute resources. 'use_parallelism' must be set when using data boost. When `null`, the `use_data_boost` field will be omitted from the resulting object.
+  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner. When `null`, the `use_parallelism` field will be omitted from the resulting object.
+  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. 'useParallelism' must be set when using serverless analytics. When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `cloud_spanner` sub block.
@@ -606,6 +656,76 @@ Terraform sub block.
   - An attribute object that represents the `credential` sub block.
 
 
+## obj spark
+
+
+
+### fn spark.new
+
+```ts
+new()
+```
+
+
+`google.bigquery_connection.spark.new` constructs a new object with attributes and blocks configured for the `spark`
+Terraform sub block.
+
+
+
+**Args**:
+  - `metastore_service_config` (`list[obj]`): Dataproc Metastore Service configuration for the connection. When `null`, the `metastore_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.metastore_service_config.new](#fn-sparkmetastore_service_confignew) constructor.
+  - `spark_history_server_config` (`list[obj]`): Spark History Server configuration for the connection. When `null`, the `spark_history_server_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_connection.spark.spark_history_server_config.new](#fn-sparkspark_history_server_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `spark` sub block.
+
+
+## obj spark.metastore_service_config
+
+
+
+### fn spark.metastore_service_config.new
+
+```ts
+new()
+```
+
+
+`google.bigquery_connection.spark.metastore_service_config.new` constructs a new object with attributes and blocks configured for the `metastore_service_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `metastore_service` (`string`): Resource name of an existing Dataproc Metastore service in the form of projects/[projectId]/locations/[region]/services/[serviceId]. When `null`, the `metastore_service` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `metastore_service_config` sub block.
+
+
+## obj spark.spark_history_server_config
+
+
+
+### fn spark.spark_history_server_config.new
+
+```ts
+new()
+```
+
+
+`google.bigquery_connection.spark.spark_history_server_config.new` constructs a new object with attributes and blocks configured for the `spark_history_server_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dataproc_cluster` (`string`): Resource name of an existing Dataproc Cluster to act as a Spark History Server for the connection if the form of projects/[projectId]/regions/[region]/clusters/[cluster_name]. When `null`, the `dataproc_cluster` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `spark_history_server_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/bigquery_dataset.md b/docs/4.x/bigquery_dataset.md
index 6fadc9d9..8990a062 100644
--- a/docs/4.x/bigquery_dataset.md
+++ b/docs/4.x/bigquery_dataset.md
@@ -128,7 +128,11 @@ destroying the resource will fail if tables are present. When `null`, the `delet
 By default, this is FALSE, which means the dataset and its table names are
 case-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels associated with this dataset. You can use these to
-organize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.
+organize and group your datasets.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location where the dataset should reside.
 See [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).
 
@@ -226,7 +230,11 @@ destroying the resource will fail if tables are present. When `null`, the `delet
 By default, this is FALSE, which means the dataset and its table names are
 case-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels associated with this dataset. You can use these to
-organize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.
+organize and group your datasets.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location where the dataset should reside.
 See [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).
 
@@ -594,6 +602,8 @@ Terraform sub block.
   - `domain` (`string`): A domain to grant access to. Any users signed in with the
 domain specified will be granted the specified access When `null`, the `domain` field will be omitted from the resulting object.
   - `group_by_email` (`string`): An email address of a Google Group to grant access to. When `null`, the `group_by_email` field will be omitted from the resulting object.
+  - `iam_member` (`string`): Some other type of member that appears in the IAM Policy but isn't a user,
+group, domain, or special group. For example: 'allUsers' When `null`, the `iam_member` field will be omitted from the resulting object.
   - `role` (`string`): Describes the rights granted to the user specified by the other
 member of the access object. Basic, predefined, and custom roles
 are supported. Predefined roles that have equivalent basic roles
diff --git a/docs/4.x/bigquery_job.md b/docs/4.x/bigquery_job.md
index c1bc5de8..f8979d56 100644
--- a/docs/4.x/bigquery_job.md
+++ b/docs/4.x/bigquery_job.md
@@ -100,7 +100,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.
   - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.
@@ -133,7 +137,11 @@ injecting into a complete block.
 **Args**:
   - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.
   - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.
@@ -1014,6 +1022,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/bigquery_routine.md b/docs/4.x/bigquery_routine.md
index b4dcb059..875b3d14 100644
--- a/docs/4.x/bigquery_routine.md
+++ b/docs/4.x/bigquery_routine.md
@@ -28,10 +28,14 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withReturnType()`](#fn-withreturntype)
 * [`fn withRoutineId()`](#fn-withroutineid)
 * [`fn withRoutineType()`](#fn-withroutinetype)
+* [`fn withSparkOptions()`](#fn-withsparkoptions)
+* [`fn withSparkOptionsMixin()`](#fn-withsparkoptionsmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj arguments`](#obj-arguments)
   * [`fn new()`](#fn-argumentsnew)
+* [`obj spark_options`](#obj-spark_options)
+  * [`fn new()`](#fn-spark_optionsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -71,7 +75,7 @@ If language=SQL, it is the substring inside (but excluding) the parentheses.
   - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: ["DETERMINISM_LEVEL_UNSPECIFIED", "DETERMINISTIC", "NOT_DETERMINISTIC"] When `null`, the `determinism_level` field will be omitted from the resulting object.
   - `imported_libraries` (`list`): Optional. If language = "JAVASCRIPT", this field stores the path of the
 imported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.
-  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT"] When `null`, the `language` field will be omitted from the resulting object.
+  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT", "PYTHON", "JAVA", "SCALA"] When `null`, the `language` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `return_table_type` (`string`): Optional. Can be set only if routineType = "TABLE_VALUED_FUNCTION".
 
@@ -88,8 +92,9 @@ d the order of values or replaced STRUCT field type with RECORD field type, we c
 cannot suppress the recurring diff this causes. As a workaround, we recommend using
 the schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.
   - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
-  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"] When `null`, the `routine_type` field will be omitted from the resulting object.
+  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"]
   - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.
+  - `spark_options` (`list[obj]`): Optional. If language is one of "PYTHON", "JAVA", "SCALA", this field stores the options for spark stored procedure. When `null`, the `spark_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.spark_options.new](#fn-spark_optionsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -121,7 +126,7 @@ If language=SQL, it is the substring inside (but excluding) the parentheses.
   - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: ["DETERMINISM_LEVEL_UNSPECIFIED", "DETERMINISTIC", "NOT_DETERMINISTIC"] When `null`, the `determinism_level` field will be omitted from the resulting object.
   - `imported_libraries` (`list`): Optional. If language = "JAVASCRIPT", this field stores the path of the
 imported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.
-  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT"] When `null`, the `language` field will be omitted from the resulting object.
+  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT", "PYTHON", "JAVA", "SCALA"] When `null`, the `language` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `return_table_type` (`string`): Optional. Can be set only if routineType = "TABLE_VALUED_FUNCTION".
 
@@ -138,8 +143,9 @@ d the order of values or replaced STRUCT field type with RECORD field type, we c
 cannot suppress the recurring diff this causes. As a workaround, we recommend using
 the schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.
   - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
-  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"] When `null`, the `routine_type` field will be omitted from the resulting object.
+  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"]
   - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.
+  - `spark_options` (`list[obj]`): Optional. If language is one of "PYTHON", "JAVA", "SCALA", this field stores the options for spark stored procedure. When `null`, the `spark_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.spark_options.new](#fn-spark_optionsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -359,6 +365,43 @@ Terraform resource block to set or update the routine_type field.
   - `value` (`string`): The value to set for the `routine_type` field.
 
 
+### fn withSparkOptions
+
+```ts
+withSparkOptions()
+```
+
+`google.list[obj].withSparkOptions` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the spark_options field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSparkOptionsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `spark_options` field.
+
+
+### fn withSparkOptionsMixin
+
+```ts
+withSparkOptionsMixin()
+```
+
+`google.list[obj].withSparkOptionsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the spark_options field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSparkOptions](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `spark_options` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -427,6 +470,44 @@ the schema as returned by the API. When `null`, the `data_type` field will be om
   - An attribute object that represents the `arguments` sub block.
 
 
+## obj spark_options
+
+
+
+### fn spark_options.new
+
+```ts
+new()
+```
+
+
+`google.bigquery_routine.spark_options.new` constructs a new object with attributes and blocks configured for the `spark_options`
+Terraform sub block.
+
+
+
+**Args**:
+  - `archive_uris` (`list`): Archive files to be extracted into the working directory of each executor. For more information about Apache Spark, see Apache Spark. When `null`, the `archive_uris` field will be omitted from the resulting object.
+  - `connection` (`string`): Fully qualified name of the user-provided Spark connection object.
+Format: "projects/{projectId}/locations/{locationId}/connections/{connectionId}" When `null`, the `connection` field will be omitted from the resulting object.
+  - `container_image` (`string`): Custom container image for the runtime environment. When `null`, the `container_image` field will be omitted from the resulting object.
+  - `file_uris` (`list`): Files to be placed in the working directory of each executor. For more information about Apache Spark, see Apache Spark. When `null`, the `file_uris` field will be omitted from the resulting object.
+  - `jar_uris` (`list`): JARs to include on the driver and executor CLASSPATH. For more information about Apache Spark, see Apache Spark. When `null`, the `jar_uris` field will be omitted from the resulting object.
+  - `main_class` (`string`): The fully qualified name of a class in jarUris, for example, com.example.wordcount.
+Exactly one of mainClass and main_jar_uri field should be set for Java/Scala language type. When `null`, the `main_class` field will be omitted from the resulting object.
+  - `main_file_uri` (`string`): The main file/jar URI of the Spark application.
+Exactly one of the definitionBody field and the mainFileUri field must be set for Python.
+Exactly one of mainClass and mainFileUri field should be set for Java/Scala language type. When `null`, the `main_file_uri` field will be omitted from the resulting object.
+  - `properties` (`obj`): Configuration properties as a set of key/value pairs, which will be passed on to the Spark application.
+For more information, see Apache Spark and the procedure option list.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `properties` field will be omitted from the resulting object.
+  - `py_file_uris` (`list`): Python files to be placed on the PYTHONPATH for PySpark application. Supported file types: .py, .egg, and .zip. For more information about Apache Spark, see Apache Spark. When `null`, the `py_file_uris` field will be omitted from the resulting object.
+  - `runtime_version` (`string`): Runtime version. If not specified, the default runtime version is used. When `null`, the `runtime_version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `spark_options` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/bigquery_table.md b/docs/4.x/bigquery_table.md
index eae0d083..d7be4f4b 100644
--- a/docs/4.x/bigquery_table.md
+++ b/docs/4.x/bigquery_table.md
@@ -32,6 +32,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRangePartitioning()`](#fn-withrangepartitioning)
 * [`fn withRangePartitioningMixin()`](#fn-withrangepartitioningmixin)
+* [`fn withRequirePartitionFilter()`](#fn-withrequirepartitionfilter)
 * [`fn withSchema()`](#fn-withschema)
 * [`fn withTableConstraints()`](#fn-withtableconstraints)
 * [`fn withTableConstraintsMixin()`](#fn-withtableconstraintsmixin)
@@ -112,9 +113,13 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.
   - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.
   - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
-  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.
+  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.
   - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.
   - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.
   - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.
@@ -153,9 +158,13 @@ injecting into a complete block.
   - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.
   - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.
   - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
-  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.
+  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.
   - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.
   - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.
   - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.
@@ -462,6 +471,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `range_partitioning` field.
 
 
+### fn withRequirePartitionFilter
+
+```ts
+withRequirePartitionFilter()
+```
+
+`google.bool.withRequirePartitionFilter` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the require_partition_filter field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `require_partition_filter` field.
+
+
 ### fn withSchema
 
 ```ts
@@ -835,7 +860,7 @@ Terraform sub block.
   - `allow_non_incremental_definition` (`bool`): Allow non incremental materialized view definition. The default value is false. When `null`, the `allow_non_incremental_definition` field will be omitted from the resulting object.
   - `enable_refresh` (`bool`): Specifies if BigQuery should automatically refresh materialized view when the base table is updated. The default is true. When `null`, the `enable_refresh` field will be omitted from the resulting object.
   - `query` (`string`): A query whose result is persisted.
-  - `refresh_interval_ms` (`number`): Specifies maximum frequency at which this materialized view will be refreshed. The default is 1800000 When `null`, the `refresh_interval_ms` field will be omitted from the resulting object.
+  - `refresh_interval_ms` (`number`): Specifies maximum frequency at which this materialized view will be refreshed. The default is 1800000. When `null`, the `refresh_interval_ms` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `materialized_view` sub block.
diff --git a/docs/4.x/bigtable_app_profile.md b/docs/4.x/bigtable_app_profile.md
index 77574629..f90a7000 100644
--- a/docs/4.x/bigtable_app_profile.md
+++ b/docs/4.x/bigtable_app_profile.md
@@ -24,10 +24,14 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withSingleClusterRouting()`](#fn-withsingleclusterrouting)
 * [`fn withSingleClusterRoutingMixin()`](#fn-withsingleclusterroutingmixin)
+* [`fn withStandardIsolation()`](#fn-withstandardisolation)
+* [`fn withStandardIsolationMixin()`](#fn-withstandardisolationmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj single_cluster_routing`](#obj-single_cluster_routing)
   * [`fn new()`](#fn-single_cluster_routingnew)
+* [`obj standard_isolation`](#obj-standard_isolation)
+  * [`fn new()`](#fn-standard_isolationnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -70,6 +74,7 @@ in the event of transient errors or delays. Clusters in a region are considered
 consistency to improve availability. When `null`, the `multi_cluster_routing_use_any` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `single_cluster_routing` (`list[obj]`): Use a single-cluster routing policy. When `null`, the `single_cluster_routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.single_cluster_routing.new](#fn-single_cluster_routingnew) constructor.
+  - `standard_isolation` (`list[obj]`): The standard options used for isolating this app profile's traffic from other use cases. When `null`, the `standard_isolation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.standard_isolation.new](#fn-standard_isolationnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -104,6 +109,7 @@ in the event of transient errors or delays. Clusters in a region are considered
 consistency to improve availability. When `null`, the `multi_cluster_routing_use_any` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `single_cluster_routing` (`list[obj]`): Use a single-cluster routing policy. When `null`, the `single_cluster_routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.single_cluster_routing.new](#fn-single_cluster_routingnew) constructor.
+  - `standard_isolation` (`list[obj]`): The standard options used for isolating this app profile's traffic from other use cases. When `null`, the `standard_isolation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.standard_isolation.new](#fn-standard_isolationnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_app_profile.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -259,6 +265,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `single_cluster_routing` field.
 
 
+### fn withStandardIsolation
+
+```ts
+withStandardIsolation()
+```
+
+`google.list[obj].withStandardIsolation` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the standard_isolation field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStandardIsolationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `standard_isolation` field.
+
+
+### fn withStandardIsolationMixin
+
+```ts
+withStandardIsolationMixin()
+```
+
+`google.list[obj].withStandardIsolationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the standard_isolation field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStandardIsolation](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `standard_isolation` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -320,6 +363,29 @@ It is unsafe to send these requests to the same table/row/column in multiple clu
   - An attribute object that represents the `single_cluster_routing` sub block.
 
 
+## obj standard_isolation
+
+
+
+### fn standard_isolation.new
+
+```ts
+new()
+```
+
+
+`google.bigtable_app_profile.standard_isolation.new` constructs a new object with attributes and blocks configured for the `standard_isolation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `priority` (`string`): The priority of requests sent using this app profile. Possible values: ["PRIORITY_LOW", "PRIORITY_MEDIUM", "PRIORITY_HIGH"]
+
+**Returns**:
+  - An attribute object that represents the `standard_isolation` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/bigtable_instance.md b/docs/4.x/bigtable_instance.md
index b1b92f44..36b84206 100644
--- a/docs/4.x/bigtable_instance.md
+++ b/docs/4.x/bigtable_instance.md
@@ -64,7 +64,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.
   - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.
@@ -95,7 +98,10 @@ injecting into a complete block.
   - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.
   - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.
diff --git a/docs/4.x/blockchain_node_engine_blockchain_nodes.md b/docs/4.x/blockchain_node_engine_blockchain_nodes.md
new file mode 100644
index 00000000..387a4839
--- /dev/null
+++ b/docs/4.x/blockchain_node_engine_blockchain_nodes.md
@@ -0,0 +1,366 @@
+---
+permalink: /blockchain_node_engine_blockchain_nodes/
+---
+
+# blockchain_node_engine_blockchain_nodes
+
+`blockchain_node_engine_blockchain_nodes` represents the `google_blockchain_node_engine_blockchain_nodes` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBlockchainNodeId()`](#fn-withblockchainnodeid)
+* [`fn withBlockchainType()`](#fn-withblockchaintype)
+* [`fn withEthereumDetails()`](#fn-withethereumdetails)
+* [`fn withEthereumDetailsMixin()`](#fn-withethereumdetailsmixin)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj ethereum_details`](#obj-ethereum_details)
+  * [`fn new()`](#fn-ethereum_detailsnew)
+  * [`obj ethereum_details.geth_details`](#obj-ethereum_detailsgeth_details)
+    * [`fn new()`](#fn-ethereum_detailsgeth_detailsnew)
+  * [`obj ethereum_details.validator_config`](#obj-ethereum_detailsvalidator_config)
+    * [`fn new()`](#fn-ethereum_detailsvalidator_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.blockchain_node_engine_blockchain_nodes.new` injects a new `google_blockchain_node_engine_blockchain_nodes` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.blockchain_node_engine_blockchain_nodes.new('some_id')
+
+You can get the reference to the `id` field of the created `google.blockchain_node_engine_blockchain_nodes` using the reference:
+
+    $._ref.google_blockchain_node_engine_blockchain_nodes.some_id.get('id')
+
+This is the same as directly entering `"${ google_blockchain_node_engine_blockchain_nodes.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `blockchain_node_id` (`string`): ID of the requesting object.
+  - `blockchain_type` (`string`): User-provided key-value pairs Possible values: ["ETHEREUM"] When `null`, the `blockchain_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-provided key-value pairs
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location of Blockchain Node being created.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `ethereum_details` (`list[obj]`): User-provided key-value pairs When `null`, the `ethereum_details` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.new](#fn-ethereum_detailsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.blockchain_node_engine_blockchain_nodes.newAttrs` constructs a new object with attributes and blocks configured for the `blockchain_node_engine_blockchain_nodes`
+Terraform resource.
+
+Unlike [google.blockchain_node_engine_blockchain_nodes.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `blockchain_node_id` (`string`): ID of the requesting object.
+  - `blockchain_type` (`string`): User-provided key-value pairs Possible values: ["ETHEREUM"] When `null`, the `blockchain_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-provided key-value pairs
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location of Blockchain Node being created.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `ethereum_details` (`list[obj]`): User-provided key-value pairs When `null`, the `ethereum_details` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.new](#fn-ethereum_detailsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `blockchain_node_engine_blockchain_nodes` resource into the root Terraform configuration.
+
+
+### fn withBlockchainNodeId
+
+```ts
+withBlockchainNodeId()
+```
+
+`google.string.withBlockchainNodeId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the blockchain_node_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `blockchain_node_id` field.
+
+
+### fn withBlockchainType
+
+```ts
+withBlockchainType()
+```
+
+`google.string.withBlockchainType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the blockchain_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `blockchain_type` field.
+
+
+### fn withEthereumDetails
+
+```ts
+withEthereumDetails()
+```
+
+`google.list[obj].withEthereumDetails` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ethereum_details field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withEthereumDetailsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ethereum_details` field.
+
+
+### fn withEthereumDetailsMixin
+
+```ts
+withEthereumDetailsMixin()
+```
+
+`google.list[obj].withEthereumDetailsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ethereum_details field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withEthereumDetails](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ethereum_details` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj ethereum_details
+
+
+
+### fn ethereum_details.new
+
+```ts
+new()
+```
+
+
+`google.blockchain_node_engine_blockchain_nodes.ethereum_details.new` constructs a new object with attributes and blocks configured for the `ethereum_details`
+Terraform sub block.
+
+
+
+**Args**:
+  - `api_enable_admin` (`bool`): Enables JSON-RPC access to functions in the admin namespace. Defaults to false. When `null`, the `api_enable_admin` field will be omitted from the resulting object.
+  - `api_enable_debug` (`bool`): Enables JSON-RPC access to functions in the debug namespace. Defaults to false. When `null`, the `api_enable_debug` field will be omitted from the resulting object.
+  - `consensus_client` (`string`): The consensus client Possible values: ["CONSENSUS_CLIENT_UNSPECIFIED", "LIGHTHOUSE"] When `null`, the `consensus_client` field will be omitted from the resulting object.
+  - `execution_client` (`string`): The execution client Possible values: ["EXECUTION_CLIENT_UNSPECIFIED", "GETH", "ERIGON"] When `null`, the `execution_client` field will be omitted from the resulting object.
+  - `network` (`string`): The Ethereum environment being accessed. Possible values: ["MAINNET", "TESTNET_GOERLI_PRATER", "TESTNET_SEPOLIA"] When `null`, the `network` field will be omitted from the resulting object.
+  - `node_type` (`string`): The type of Ethereum node. Possible values: ["LIGHT", "FULL", "ARCHIVE"] When `null`, the `node_type` field will be omitted from the resulting object.
+  - `geth_details` (`list[obj]`): User-provided key-value pairs When `null`, the `geth_details` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.geth_details.new](#fn-ethereum_detailsgeth_detailsnew) constructor.
+  - `validator_config` (`list[obj]`): Configuration for validator-related parameters on the beacon client, and for any managed validator client. When `null`, the `validator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.blockchain_node_engine_blockchain_nodes.ethereum_details.validator_config.new](#fn-ethereum_detailsvalidator_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ethereum_details` sub block.
+
+
+## obj ethereum_details.geth_details
+
+
+
+### fn ethereum_details.geth_details.new
+
+```ts
+new()
+```
+
+
+`google.blockchain_node_engine_blockchain_nodes.ethereum_details.geth_details.new` constructs a new object with attributes and blocks configured for the `geth_details`
+Terraform sub block.
+
+
+
+**Args**:
+  - `garbage_collection_mode` (`string`): Blockchain garbage collection modes. Only applicable when NodeType is FULL or ARCHIVE. Possible values: ["FULL", "ARCHIVE"] When `null`, the `garbage_collection_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `geth_details` sub block.
+
+
+## obj ethereum_details.validator_config
+
+
+
+### fn ethereum_details.validator_config.new
+
+```ts
+new()
+```
+
+
+`google.blockchain_node_engine_blockchain_nodes.ethereum_details.validator_config.new` constructs a new object with attributes and blocks configured for the `validator_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `mev_relay_urls` (`list`): URLs for MEV-relay services to use for block building. When set, a managed MEV-boost service is configured on the beacon client. When `null`, the `mev_relay_urls` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `validator_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.blockchain_node_engine_blockchain_nodes.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/certificate_manager_certificate.md b/docs/4.x/certificate_manager_certificate.md
index 2d9ced8a..a5ccf2f3 100644
--- a/docs/4.x/certificate_manager_certificate.md
+++ b/docs/4.x/certificate_manager_certificate.md
@@ -64,7 +64,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Certificate resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
@@ -75,11 +78,11 @@ and all following characters must be a dash, underscore, letter or digit.
 DEFAULT: Certificates with default scope are served from core Google data centers.
 If unsure, choose this option.
 
-EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,
-served from non-core Google data centers.
+EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
+See https://cloud.google.com/vpc/docs/edge-locations.
 
 ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
-see https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
+See https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
   - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.
 Certificate Manager provisions and renews Managed Certificates
 automatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.
@@ -111,7 +114,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Certificate resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
@@ -122,11 +128,11 @@ and all following characters must be a dash, underscore, letter or digit.
 DEFAULT: Certificates with default scope are served from core Google data centers.
 If unsure, choose this option.
 
-EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,
-served from non-core Google data centers.
+EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
+See https://cloud.google.com/vpc/docs/edge-locations.
 
 ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
-see https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
+See https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
   - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.
 Certificate Manager provisions and renews Managed Certificates
 automatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.
diff --git a/docs/4.x/certificate_manager_certificate_issuance_config.md b/docs/4.x/certificate_manager_certificate_issuance_config.md
index 6b3b7c04..33650c94 100644
--- a/docs/4.x/certificate_manager_certificate_issuance_config.md
+++ b/docs/4.x/certificate_manager_certificate_issuance_config.md
@@ -66,7 +66,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.
   - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]
   - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.
- An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.
 Example: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
@@ -105,7 +109,11 @@ injecting into a complete block.
   - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.
   - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]
   - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.
- An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.
 Example: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
@@ -391,6 +399,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/certificate_manager_certificate_map.md b/docs/4.x/certificate_manager_certificate_map.md
index 510efe99..d5fe702b 100644
--- a/docs/4.x/certificate_manager_certificate_map.md
+++ b/docs/4.x/certificate_manager_certificate_map.md
@@ -54,7 +54,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique
 globally and match the pattern 'projects/*/locations/*/certificateMaps/*'.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -83,7 +87,11 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique
 globally and match the pattern 'projects/*/locations/*/certificateMaps/*'.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/certificate_manager_certificate_map_entry.md b/docs/4.x/certificate_manager_certificate_map_entry.md
index 06ecbf03..d84dfea3 100644
--- a/docs/4.x/certificate_manager_certificate_map_entry.md
+++ b/docs/4.x/certificate_manager_certificate_map_entry.md
@@ -66,7 +66,11 @@ for a set of hostnames with common suffix. Used as Server Name Indication (SNI)
 selecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `map` (`string`): A map entry that is inputted into the cetrificate map
   - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry
@@ -106,7 +110,11 @@ for a set of hostnames with common suffix. Used as Server Name Indication (SNI)
 selecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `map` (`string`): A map entry that is inputted into the cetrificate map
   - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry
diff --git a/docs/4.x/certificate_manager_dns_authorization.md b/docs/4.x/certificate_manager_dns_authorization.md
index 0fb1de40..c8ea0d75 100644
--- a/docs/4.x/certificate_manager_dns_authorization.md
+++ b/docs/4.x/certificate_manager_dns_authorization.md
@@ -58,7 +58,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a
 single domain and its wildcard, e.g. authorization for "example.com" can
 be used to issue certificates for "example.com" and "*.example.com".
-  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
@@ -91,7 +94,10 @@ injecting into a complete block.
   - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a
 single domain and its wildcard, e.g. authorization for "example.com" can
 be used to issue certificates for "example.com" and "*.example.com".
-  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
diff --git a/docs/4.x/certificate_manager_trust_config.md b/docs/4.x/certificate_manager_trust_config.md
index d0fa3cf7..48c20f1a 100644
--- a/docs/4.x/certificate_manager_trust_config.md
+++ b/docs/4.x/certificate_manager_trust_config.md
@@ -63,7 +63,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the trust config.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The trust config location.
   - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -94,7 +97,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the trust config.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The trust config location.
   - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/cloud_identity_group_membership.md b/docs/4.x/cloud_identity_group_membership.md
index d426edf6..5d3f404e 100644
--- a/docs/4.x/cloud_identity_group_membership.md
+++ b/docs/4.x/cloud_identity_group_membership.md
@@ -26,6 +26,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-preferred_member_keynew)
 * [`obj roles`](#obj-roles)
   * [`fn new()`](#fn-rolesnew)
+  * [`obj roles.expiry_detail`](#obj-rolesexpiry_detail)
+    * [`fn new()`](#fn-rolesexpiry_detailnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -270,11 +272,41 @@ Terraform sub block.
 
 **Args**:
   - `name` (`string`): The name of the MembershipRole. Must be one of OWNER, MANAGER, MEMBER. Possible values: ["OWNER", "MANAGER", "MEMBER"]
+  - `expiry_detail` (`list[obj]`): The MembershipRole expiry details, only supported for MEMBER role.
+Other roles cannot be accompanied with MEMBER role having expiry. When `null`, the `expiry_detail` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_identity_group_membership.roles.expiry_detail.new](#fn-rolesexpiry_detailnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `roles` sub block.
 
 
+## obj roles.expiry_detail
+
+
+
+### fn roles.expiry_detail.new
+
+```ts
+new()
+```
+
+
+`google.cloud_identity_group_membership.roles.expiry_detail.new` constructs a new object with attributes and blocks configured for the `expiry_detail`
+Terraform sub block.
+
+
+
+**Args**:
+  - `expire_time` (`string`): The time at which the MembershipRole will expire.
+
+A timestamp in RFC3339 UTC "Zulu" format, with nanosecond
+resolution and up to nine fractional digits.
+
+Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+
+**Returns**:
+  - An attribute object that represents the `expiry_detail` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/cloud_run_domain_mapping.md b/docs/4.x/cloud_run_domain_mapping.md
index 18b8a930..907c39b5 100644
--- a/docs/4.x/cloud_run_domain_mapping.md
+++ b/docs/4.x/cloud_run_domain_mapping.md
@@ -281,11 +281,17 @@ info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotati
 
 **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
 If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
-or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field. When `null`, the `annotations` field will be omitted from the resulting object.
+or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize
 (scope and select) objects. May match selectors of replication controllers
 and routes.
-More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels When `null`, the `labels` field will be omitted from the resulting object.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace` (`string`): In Cloud Run the namespace must be equal to either the
 project ID or project number.
 
diff --git a/docs/4.x/cloud_run_service.md b/docs/4.x/cloud_run_service.md
index ed37c4fc..765bfb88 100644
--- a/docs/4.x/cloud_run_service.md
+++ b/docs/4.x/cloud_run_service.md
@@ -445,10 +445,16 @@ keys to configure features on a Service:
 - 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)
   for the Service. For example, '"run.googleapis.com/ingress" = "all"'.
 - 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)
-  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"' When `null`, the `annotations` field will be omitted from the resulting object.
+  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"'
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize
 (scope and select) objects. May match selectors of replication controllers
-and routes. When `null`, the `labels` field will be omitted from the resulting object.
+and routes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace` (`string`): In Cloud Run the namespace must be equal to either the
 project ID or project number. When `null`, the `namespace` field will be omitted from the resulting object.
 
diff --git a/docs/4.x/cloud_run_v2_job.md b/docs/4.x/cloud_run_v2_job.md
index 272718cf..0affcdf5 100644
--- a/docs/4.x/cloud_run_v2_job.md
+++ b/docs/4.x/cloud_run_v2_job.md
@@ -43,26 +43,10 @@ This package contains functions and utilities for setting up the resource using
           * [`fn new()`](#fn-templatetemplatecontainersenvvalue_sourcenew)
           * [`obj template.template.containers.env.value_source.secret_key_ref`](#obj-templatetemplatecontainersenvvalue_sourcesecret_key_ref)
             * [`fn new()`](#fn-templatetemplatecontainersenvvalue_sourcesecret_key_refnew)
-      * [`obj template.template.containers.liveness_probe`](#obj-templatetemplatecontainersliveness_probe)
-        * [`fn new()`](#fn-templatetemplatecontainersliveness_probenew)
-        * [`obj template.template.containers.liveness_probe.http_get`](#obj-templatetemplatecontainersliveness_probehttp_get)
-          * [`fn new()`](#fn-templatetemplatecontainersliveness_probehttp_getnew)
-          * [`obj template.template.containers.liveness_probe.http_get.http_headers`](#obj-templatetemplatecontainersliveness_probehttp_gethttp_headers)
-            * [`fn new()`](#fn-templatetemplatecontainersliveness_probehttp_gethttp_headersnew)
-        * [`obj template.template.containers.liveness_probe.tcp_socket`](#obj-templatetemplatecontainersliveness_probetcp_socket)
-          * [`fn new()`](#fn-templatetemplatecontainersliveness_probetcp_socketnew)
       * [`obj template.template.containers.ports`](#obj-templatetemplatecontainersports)
         * [`fn new()`](#fn-templatetemplatecontainersportsnew)
       * [`obj template.template.containers.resources`](#obj-templatetemplatecontainersresources)
         * [`fn new()`](#fn-templatetemplatecontainersresourcesnew)
-      * [`obj template.template.containers.startup_probe`](#obj-templatetemplatecontainersstartup_probe)
-        * [`fn new()`](#fn-templatetemplatecontainersstartup_probenew)
-        * [`obj template.template.containers.startup_probe.http_get`](#obj-templatetemplatecontainersstartup_probehttp_get)
-          * [`fn new()`](#fn-templatetemplatecontainersstartup_probehttp_getnew)
-          * [`obj template.template.containers.startup_probe.http_get.http_headers`](#obj-templatetemplatecontainersstartup_probehttp_gethttp_headers)
-            * [`fn new()`](#fn-templatetemplatecontainersstartup_probehttp_gethttp_headersnew)
-        * [`obj template.template.containers.startup_probe.tcp_socket`](#obj-templatetemplatecontainersstartup_probetcp_socket)
-          * [`fn new()`](#fn-templatetemplatecontainersstartup_probetcp_socketnew)
       * [`obj template.template.containers.volume_mounts`](#obj-templatetemplatecontainersvolume_mounts)
         * [`fn new()`](#fn-templatetemplatecontainersvolume_mountsnew)
     * [`obj template.template.volumes`](#obj-templatetemplatevolumes)
@@ -114,19 +98,25 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.
 All system annotations in v1 now have a corresponding field in v2 Job.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
   - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Job.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run job
   - `name` (`string`): Name of the Job.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -160,19 +150,25 @@ injecting into a complete block.
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.
 All system annotations in v1 now have a corresponding field in v2 Job.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
   - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Job.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run job
   - `name` (`string`): Name of the Job.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -537,14 +533,10 @@ Terraform sub block.
   - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.
   - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.
   - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.env.new](#fn-templatetemplatetemplateenvnew) constructor.
-  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-This field is not supported in Cloud Run Job currently. When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.new](#fn-templatetemplatetemplateliveness_probenew) constructor.
   - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.
 
 If omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.ports.new](#fn-templatetemplatetemplateportsnew) constructor.
   - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.resources.new](#fn-templatetemplatetemplateresourcesnew) constructor.
-  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-This field is not supported in Cloud Run Job currently. When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.new](#fn-templatetemplatetemplatestartup_probenew) constructor.
   - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.volume_mounts.new](#fn-templatetemplatetemplatevolume_mountsnew) constructor.
 
 **Returns**:
@@ -623,105 +615,6 @@ Terraform sub block.
   - An attribute object that represents the `secret_key_ref` sub block.
 
 
-## obj template.template.containers.liveness_probe
-
-
-
-### fn template.template.containers.liveness_probe.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`
-Terraform sub block.
-
-
-
-**Args**:
-  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.
-  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.
-  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.
-  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.
-  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.
-  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `liveness_probe` sub block.
-
-
-## obj template.template.containers.liveness_probe.http_get
-
-
-
-### fn template.template.containers.liveness_probe.http_get.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`
-Terraform sub block.
-
-
-
-**Args**:
-  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.
-  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersliveness_probehttp_headersnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `http_get` sub block.
-
-
-## obj template.template.containers.liveness_probe.http_get.http_headers
-
-
-
-### fn template.template.containers.liveness_probe.http_get.http_headers.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`
-Terraform sub block.
-
-
-
-**Args**:
-  - `name` (`string`): The header field name
-  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `http_headers` sub block.
-
-
-## obj template.template.containers.liveness_probe.tcp_socket
-
-
-
-### fn template.template.containers.liveness_probe.tcp_socket.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`
-Terraform sub block.
-
-
-
-**Args**:
-  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `tcp_socket` sub block.
-
-
 ## obj template.template.containers.ports
 
 
@@ -763,111 +656,12 @@ Terraform sub block.
 
 
 **Args**:
-  - `limits` (`obj`): Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.
+  - `limits` (`obj`): Only memory and CPU are supported. Use key 'cpu' for CPU limit and 'memory' for memory limit. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `resources` sub block.
 
 
-## obj template.template.containers.startup_probe
-
-
-
-### fn template.template.containers.startup_probe.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.new` constructs a new object with attributes and blocks configured for the `startup_probe`
-Terraform sub block.
-
-
-
-**Args**:
-  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.
-  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.
-  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.
-  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.
-  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.
-  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `startup_probe` sub block.
-
-
-## obj template.template.containers.startup_probe.http_get
-
-
-
-### fn template.template.containers.startup_probe.http_get.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`
-Terraform sub block.
-
-
-
-**Args**:
-  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.
-  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersstartup_probehttp_headersnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `http_get` sub block.
-
-
-## obj template.template.containers.startup_probe.http_get.http_headers
-
-
-
-### fn template.template.containers.startup_probe.http_get.http_headers.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`
-Terraform sub block.
-
-
-
-**Args**:
-  - `name` (`string`): The header field name
-  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `http_headers` sub block.
-
-
-## obj template.template.containers.startup_probe.tcp_socket
-
-
-
-### fn template.template.containers.startup_probe.tcp_socket.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`
-Terraform sub block.
-
-
-
-**Args**:
-  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `tcp_socket` sub block.
-
-
 ## obj template.template.containers.volume_mounts
 
 
diff --git a/docs/4.x/cloud_run_v2_service.md b/docs/4.x/cloud_run_v2_service.md
index 43aaa411..0377c869 100644
--- a/docs/4.x/cloud_run_v2_service.md
+++ b/docs/4.x/cloud_run_v2_service.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withBinaryAuthorizationMixin()`](#fn-withbinaryauthorizationmixin)
 * [`fn withClient()`](#fn-withclient)
 * [`fn withClientVersion()`](#fn-withclientversion)
+* [`fn withCustomAudiences()`](#fn-withcustomaudiences)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withIngress()`](#fn-withingress)
 * [`fn withLabels()`](#fn-withlabels)
@@ -77,6 +78,10 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-templatevolumesnew)
     * [`obj template.volumes.cloud_sql_instance`](#obj-templatevolumescloud_sql_instance)
       * [`fn new()`](#fn-templatevolumescloud_sql_instancenew)
+    * [`obj template.volumes.gcs`](#obj-templatevolumesgcs)
+      * [`fn new()`](#fn-templatevolumesgcsnew)
+    * [`obj template.volumes.nfs`](#obj-templatevolumesnfs)
+      * [`fn new()`](#fn-templatevolumesnfsnew)
     * [`obj template.volumes.secret`](#obj-templatevolumessecret)
       * [`fn new()`](#fn-templatevolumessecretnew)
       * [`obj template.volumes.secret.items`](#obj-templatevolumessecretitems)
@@ -124,21 +129,29 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.
 All system annotations in v1 now have a corresponding field in v2 Service.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
+  - `custom_audiences` (`list`): One or more custom audiences that you want this service to support. Specify each custom audience as the full URL in a string. The custom audiences are encoded in the token and used to authenticate requests.
+For more information, see https://cloud.google.com/run/docs/configuring/custom-audiences. When `null`, the `custom_audiences` field will be omitted from the resulting object.
   - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.
   - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: ["INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"] When `null`, the `ingress` field will be omitted from the resulting object.
   - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run service
   - `name` (`string`): Name of the Service.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -173,21 +186,29 @@ injecting into a complete block.
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.
 All system annotations in v1 now have a corresponding field in v2 Service.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
+  - `custom_audiences` (`list`): One or more custom audiences that you want this service to support. Specify each custom audience as the full URL in a string. The custom audiences are encoded in the token and used to authenticate requests.
+For more information, see https://cloud.google.com/run/docs/configuring/custom-audiences. When `null`, the `custom_audiences` field will be omitted from the resulting object.
   - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.
   - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: ["INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"] When `null`, the `ingress` field will be omitted from the resulting object.
   - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run service
   - `name` (`string`): Name of the Service.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -284,6 +305,22 @@ Terraform resource block to set or update the client_version field.
   - `value` (`string`): The value to set for the `client_version` field.
 
 
+### fn withCustomAudiences
+
+```ts
+withCustomAudiences()
+```
+
+`google.list.withCustomAudiences` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the custom_audiences field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `custom_audiences` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -595,6 +632,7 @@ Terraform sub block.
 **Args**:
   - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.
   - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.
+  - `depends_on` (`list`): Containers which should be started before this container. If specified the container will wait to start until all containers with the listed names are healthy. When `null`, the `depends_on` field will be omitted from the resulting object.
   - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images
   - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.
   - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.
@@ -706,7 +744,7 @@ Terraform sub block.
   - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.
   - `grpc` (`list[obj]`): GRPC specifies an action involving a GRPC port. When `null`, the `grpc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.grpc.new](#fn-templatetemplatecontainersgrpcnew) constructor.
   - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.http_get.new](#fn-templatetemplatecontainershttp_getnew) constructor.
-  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. This field is not supported in liveness probe currently. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatecontainerstcp_socketnew) constructor.
+  - `tcp_socket` (`list[obj]`): TCPSocketAction describes an action based on opening a socket When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatecontainerstcp_socketnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `liveness_probe` sub block.
@@ -806,7 +844,9 @@ Terraform sub block.
 
 
 **Args**:
-  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.
+  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535.
+If not specified, defaults to the exposed port of the container, which
+is the value of container.ports[0].containerPort.
 
 **Returns**:
   - An attribute object that represents the `tcp_socket` sub block.
@@ -854,7 +894,7 @@ Terraform sub block.
 
 **Args**:
   - `cpu_idle` (`bool`): Determines whether CPU should be throttled or not outside of requests. When `null`, the `cpu_idle` field will be omitted from the resulting object.
-  - `limits` (`obj`): Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.
+  - `limits` (`obj`): Only memory and CPU are supported. Use key 'cpu' for CPU limit and 'memory' for memory limit. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go When `null`, the `limits` field will be omitted from the resulting object.
   - `startup_cpu_boost` (`bool`): Determines whether CPU should be boosted on startup of a new container instance above the requested CPU threshold, this can help reduce cold-start latency. When `null`, the `startup_cpu_boost` field will be omitted from the resulting object.
 
 **Returns**:
@@ -1058,6 +1098,8 @@ Terraform sub block.
 **Args**:
   - `name` (`string`): Volume's name.
   - `cloud_sql_instance` (`list[obj]`): For Cloud SQL volumes, contains the specific instances that should be mounted. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run. When `null`, the `cloud_sql_instance` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.cloud_sql_instance.new](#fn-templatetemplatecloud_sql_instancenew) constructor.
+  - `gcs` (`list[obj]`): Represents a GCS Bucket mounted as a volume. When `null`, the `gcs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.gcs.new](#fn-templatetemplategcsnew) constructor.
+  - `nfs` (`list[obj]`): Represents an NFS mount. When `null`, the `nfs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.nfs.new](#fn-templatetemplatenfsnew) constructor.
   - `secret` (`list[obj]`): Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret When `null`, the `secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.volumes.secret.new](#fn-templatetemplatesecretnew) constructor.
 
 **Returns**:
@@ -1087,6 +1129,55 @@ Terraform sub block.
   - An attribute object that represents the `cloud_sql_instance` sub block.
 
 
+## obj template.volumes.gcs
+
+
+
+### fn template.volumes.gcs.new
+
+```ts
+new()
+```
+
+
+`google.cloud_run_v2_service.template.volumes.gcs.new` constructs a new object with attributes and blocks configured for the `gcs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bucket` (`string`): GCS Bucket name
+  - `read_only` (`bool`): If true, mount the GCS bucket as read-only When `null`, the `read_only` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `gcs` sub block.
+
+
+## obj template.volumes.nfs
+
+
+
+### fn template.volumes.nfs.new
+
+```ts
+new()
+```
+
+
+`google.cloud_run_v2_service.template.volumes.nfs.new` constructs a new object with attributes and blocks configured for the `nfs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): Path that is exported by the NFS server.
+  - `read_only` (`bool`): If true, mount the NFS volume as read only When `null`, the `read_only` field will be omitted from the resulting object.
+  - `server` (`string`): Hostname or IP address of the NFS server
+
+**Returns**:
+  - An attribute object that represents the `nfs` sub block.
+
+
 ## obj template.volumes.secret
 
 
diff --git a/docs/4.x/cloudbuild_trigger.md b/docs/4.x/cloudbuild_trigger.md
index 9813e28d..9833403a 100644
--- a/docs/4.x/cloudbuild_trigger.md
+++ b/docs/4.x/cloudbuild_trigger.md
@@ -62,8 +62,14 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-buildnew)
   * [`obj build.artifacts`](#obj-buildartifacts)
     * [`fn new()`](#fn-buildartifactsnew)
+    * [`obj build.artifacts.maven_artifacts`](#obj-buildartifactsmaven_artifacts)
+      * [`fn new()`](#fn-buildartifactsmaven_artifactsnew)
+    * [`obj build.artifacts.npm_packages`](#obj-buildartifactsnpm_packages)
+      * [`fn new()`](#fn-buildartifactsnpm_packagesnew)
     * [`obj build.artifacts.objects`](#obj-buildartifactsobjects)
       * [`fn new()`](#fn-buildartifactsobjectsnew)
+    * [`obj build.artifacts.python_packages`](#obj-buildartifactspython_packages)
+      * [`fn new()`](#fn-buildartifactspython_packagesnew)
   * [`obj build.available_secrets`](#obj-buildavailable_secrets)
     * [`fn new()`](#fn-buildavailable_secretsnew)
     * [`obj build.available_secrets.secret_manager`](#obj-buildavailable_secretssecret_manager)
@@ -1102,6 +1108,16 @@ The images will be pushed using the builder service account's credentials.
 The digests of the pushed images will be stored in the Build resource's results field.
 
 If any of the images fail to be pushed, the build is marked FAILURE. When `null`, the `images` field will be omitted from the resulting object.
+  - `maven_artifacts` (`list[obj]`): A Maven artifact to upload to Artifact Registry upon successful completion of all build steps.
+
+The location and generation of the uploaded objects will be stored in the Build resource's results field.
+
+If any objects fail to be pushed, the build is marked FAILURE. When `null`, the `maven_artifacts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.maven_artifacts.new](#fn-buildbuildmaven_artifactsnew) constructor.
+  - `npm_packages` (`list[obj]`): Npm package to upload to Artifact Registry upon successful completion of all build steps.
+
+The location and generation of the uploaded objects will be stored in the Build resource's results field.
+
+If any objects fail to be pushed, the build is marked FAILURE. When `null`, the `npm_packages` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.npm_packages.new](#fn-buildbuildnpm_packagesnew) constructor.
   - `objects` (`list[obj]`): A list of objects to be uploaded to Cloud Storage upon successful completion of all build steps.
 
 Files in the workspace matching specified paths globs will be uploaded to the
@@ -1110,11 +1126,71 @@ Cloud Storage location using the builder service account's credentials.
 The location and generation of the uploaded objects will be stored in the Build resource's results field.
 
 If any objects fail to be pushed, the build is marked FAILURE. When `null`, the `objects` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.objects.new](#fn-buildbuildobjectsnew) constructor.
+  - `python_packages` (`list[obj]`): Python package to upload to Artifact Registry upon successful completion of all build steps. A package can encapsulate multiple objects to be uploaded to a single repository.
+
+The location and generation of the uploaded objects will be stored in the Build resource's results field.
+
+If any objects fail to be pushed, the build is marked FAILURE. When `null`, the `python_packages` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_trigger.build.artifacts.python_packages.new](#fn-buildbuildpython_packagesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `artifacts` sub block.
 
 
+## obj build.artifacts.maven_artifacts
+
+
+
+### fn build.artifacts.maven_artifacts.new
+
+```ts
+new()
+```
+
+
+`google.cloudbuild_trigger.build.artifacts.maven_artifacts.new` constructs a new object with attributes and blocks configured for the `maven_artifacts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `artifact_id` (`string`): Maven artifactId value used when uploading the artifact to Artifact Registry. When `null`, the `artifact_id` field will be omitted from the resulting object.
+  - `group_id` (`string`): Maven groupId value used when uploading the artifact to Artifact Registry. When `null`, the `group_id` field will be omitted from the resulting object.
+  - `path` (`string`): Path to an artifact in the build's workspace to be uploaded to Artifact Registry. This can be either an absolute path, e.g. /workspace/my-app/target/my-app-1.0.SNAPSHOT.jar or a relative path from /workspace, e.g. my-app/target/my-app-1.0.SNAPSHOT.jar. When `null`, the `path` field will be omitted from the resulting object.
+  - `repository` (`string`): Artifact Registry repository, in the form "https://$REGION-maven.pkg.dev/$PROJECT/$REPOSITORY"
+
+Artifact in the workspace specified by path will be uploaded to Artifact Registry with this location as a prefix. When `null`, the `repository` field will be omitted from the resulting object.
+  - `version` (`string`): Maven version value used when uploading the artifact to Artifact Registry. When `null`, the `version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `maven_artifacts` sub block.
+
+
+## obj build.artifacts.npm_packages
+
+
+
+### fn build.artifacts.npm_packages.new
+
+```ts
+new()
+```
+
+
+`google.cloudbuild_trigger.build.artifacts.npm_packages.new` constructs a new object with attributes and blocks configured for the `npm_packages`
+Terraform sub block.
+
+
+
+**Args**:
+  - `package_path` (`string`): Path to the package.json. e.g. workspace/path/to/package When `null`, the `package_path` field will be omitted from the resulting object.
+  - `repository` (`string`): Artifact Registry repository, in the form "https://$REGION-npm.pkg.dev/$PROJECT/$REPOSITORY"
+
+Npm package in the workspace specified by path will be zipped and uploaded to Artifact Registry with this location as a prefix. When `null`, the `repository` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `npm_packages` sub block.
+
+
 ## obj build.artifacts.objects
 
 
@@ -1142,6 +1218,32 @@ this location as a prefix. When `null`, the `location` field will be omitted fro
   - An attribute object that represents the `objects` sub block.
 
 
+## obj build.artifacts.python_packages
+
+
+
+### fn build.artifacts.python_packages.new
+
+```ts
+new()
+```
+
+
+`google.cloudbuild_trigger.build.artifacts.python_packages.new` constructs a new object with attributes and blocks configured for the `python_packages`
+Terraform sub block.
+
+
+
+**Args**:
+  - `paths` (`list`): Path globs used to match files in the build's workspace. For Python/ Twine, this is usually dist/*, and sometimes additionally an .asc file. When `null`, the `paths` field will be omitted from the resulting object.
+  - `repository` (`string`): Artifact Registry repository, in the form "https://$REGION-python.pkg.dev/$PROJECT/$REPOSITORY"
+
+Files in the workspace matching any path pattern will be uploaded to Artifact Registry with this location as a prefix. When `null`, the `repository` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `python_packages` sub block.
+
+
 ## obj build.available_secrets
 
 
diff --git a/docs/4.x/cloudbuild_worker_pool.md b/docs/4.x/cloudbuild_worker_pool.md
index e993c601..f17287da 100644
--- a/docs/4.x/cloudbuild_worker_pool.md
+++ b/docs/4.x/cloudbuild_worker_pool.md
@@ -62,7 +62,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): User-defined name of the `WorkerPool`.
@@ -93,7 +96,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): User-defined name of the `WorkerPool`.
diff --git a/docs/4.x/cloudbuildv2_connection.md b/docs/4.x/cloudbuildv2_connection.md
index 7a41b17f..768758fa 100644
--- a/docs/4.x/cloudbuildv2_connection.md
+++ b/docs/4.x/cloudbuildv2_connection.md
@@ -76,7 +76,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.
@@ -108,7 +111,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.
diff --git a/docs/4.x/cloudbuildv2_repository.md b/docs/4.x/cloudbuildv2_repository.md
index 2b78e6bb..6d7427d1 100644
--- a/docs/4.x/cloudbuildv2_repository.md
+++ b/docs/4.x/cloudbuildv2_repository.md
@@ -55,11 +55,14 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Name of the repository.
   - `parent_connection` (`string`): The connection for the resource
-  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `remote_uri` (`string`): Required. Git Clone HTTPS URI.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -85,11 +88,14 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Name of the repository.
   - `parent_connection` (`string`): The connection for the resource
-  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `remote_uri` (`string`): Required. Git Clone HTTPS URI.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.
 
diff --git a/docs/4.x/clouddeploy_delivery_pipeline.md b/docs/4.x/clouddeploy_delivery_pipeline.md
index 682a2d58..d8f18a0c 100644
--- a/docs/4.x/clouddeploy_delivery_pipeline.md
+++ b/docs/4.x/clouddeploy_delivery_pipeline.md
@@ -38,10 +38,18 @@ This package contains functions and utilities for setting up the resource using
         * [`fn new()`](#fn-serial_pipelinestagesstrategycanarynew)
         * [`obj serial_pipeline.stages.strategy.canary.canary_deployment`](#obj-serial_pipelinestagesstrategycanarycanary_deployment)
           * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycanary_deploymentnew)
+          * [`obj serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy`](#obj-serial_pipelinestagesstrategycanarycanary_deploymentpostdeploy)
+            * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycanary_deploymentpostdeploynew)
+          * [`obj serial_pipeline.stages.strategy.canary.canary_deployment.predeploy`](#obj-serial_pipelinestagesstrategycanarycanary_deploymentpredeploy)
+            * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycanary_deploymentpredeploynew)
         * [`obj serial_pipeline.stages.strategy.canary.custom_canary_deployment`](#obj-serial_pipelinestagesstrategycanarycustom_canary_deployment)
           * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycustom_canary_deploymentnew)
           * [`obj serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs`](#obj-serial_pipelinestagesstrategycanarycustom_canary_deploymentphase_configs)
             * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycustom_canary_deploymentphase_configsnew)
+            * [`obj serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy`](#obj-serial_pipelinestagesstrategycanarycustom_canary_deploymentphase_configspostdeploy)
+              * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycustom_canary_deploymentphase_configspostdeploynew)
+            * [`obj serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy`](#obj-serial_pipelinestagesstrategycanarycustom_canary_deploymentphase_configspredeploy)
+              * [`fn new()`](#fn-serial_pipelinestagesstrategycanarycustom_canary_deploymentphase_configspredeploynew)
         * [`obj serial_pipeline.stages.strategy.canary.runtime_config`](#obj-serial_pipelinestagesstrategycanaryruntime_config)
           * [`fn new()`](#fn-serial_pipelinestagesstrategycanaryruntime_confignew)
           * [`obj serial_pipeline.stages.strategy.canary.runtime_config.cloud_run`](#obj-serial_pipelinestagesstrategycanaryruntime_configcloud_run)
@@ -54,6 +62,10 @@ This package contains functions and utilities for setting up the resource using
               * [`fn new()`](#fn-serial_pipelinestagesstrategycanaryruntime_configkubernetesservice_networkingnew)
       * [`obj serial_pipeline.stages.strategy.standard`](#obj-serial_pipelinestagesstrategystandard)
         * [`fn new()`](#fn-serial_pipelinestagesstrategystandardnew)
+        * [`obj serial_pipeline.stages.strategy.standard.postdeploy`](#obj-serial_pipelinestagesstrategystandardpostdeploy)
+          * [`fn new()`](#fn-serial_pipelinestagesstrategystandardpostdeploynew)
+        * [`obj serial_pipeline.stages.strategy.standard.predeploy`](#obj-serial_pipelinestagesstrategystandardpredeploy)
+          * [`fn new()`](#fn-serial_pipelinestagesstrategystandardpredeploynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -86,9 +98,15 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -118,9 +136,15 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -458,11 +482,59 @@ Terraform sub block.
 **Args**:
   - `percentages` (`list`): Required. The percentage based deployments that will occur as a part of a `Rollout`. List is expected in ascending order and each integer n is 0 <= n < 100.
   - `verify` (`bool`): Whether to run verify tests after each percentage deployment. When `null`, the `verify` field will be omitted from the resulting object.
+  - `postdeploy` (`list[obj]`): Optional. Configuration for the postdeploy job of the last phase. If this is not configured, postdeploy job will not be present. When `null`, the `postdeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarypostdeploynew) constructor.
+  - `predeploy` (`list[obj]`): Optional. Configuration for the predeploy job of the first phase. If this is not configured, predeploy job will not be present. When `null`, the `predeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.predeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarypredeploynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `canary_deployment` sub block.
 
 
+## obj serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy
+
+
+
+### fn serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy.new
+
+```ts
+new()
+```
+
+
+`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.postdeploy.new` constructs a new object with attributes and blocks configured for the `postdeploy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the postdeploy job. When `null`, the `actions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `postdeploy` sub block.
+
+
+## obj serial_pipeline.stages.strategy.canary.canary_deployment.predeploy
+
+
+
+### fn serial_pipeline.stages.strategy.canary.canary_deployment.predeploy.new
+
+```ts
+new()
+```
+
+
+`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.canary_deployment.predeploy.new` constructs a new object with attributes and blocks configured for the `predeploy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the predeploy job. When `null`, the `actions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predeploy` sub block.
+
+
 ## obj serial_pipeline.stages.strategy.canary.custom_canary_deployment
 
 
@@ -507,11 +579,59 @@ Terraform sub block.
   - `phase_id` (`string`): Required. The ID to assign to the `Rollout` phase. This value must consist of lower-case letters, numbers, and hyphens, start with a letter and end with a letter or a number, and have a max length of 63 characters. In other words, it must match the following regex: `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`.
   - `profiles` (`list`): Skaffold profiles to use when rendering the manifest for this phase. These are in addition to the profiles list specified in the `DeliveryPipeline` stage. When `null`, the `profiles` field will be omitted from the resulting object.
   - `verify` (`bool`): Whether to run verify tests after the deployment. When `null`, the `verify` field will be omitted from the resulting object.
+  - `postdeploy` (`list[obj]`): Optional. Configuration for the postdeploy job of this phase. If this is not configured, postdeploy job will not be present for this phase. When `null`, the `postdeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarycustom_canary_deploymentpostdeploynew) constructor.
+  - `predeploy` (`list[obj]`): Optional. Configuration for the predeploy job of this phase. If this is not configured, predeploy job will not be present for this phase. When `null`, the `predeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategycanarycustom_canary_deploymentpredeploynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `phase_configs` sub block.
 
 
+## obj serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy
+
+
+
+### fn serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy.new
+
+```ts
+new()
+```
+
+
+`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.postdeploy.new` constructs a new object with attributes and blocks configured for the `postdeploy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the postdeploy job. When `null`, the `actions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `postdeploy` sub block.
+
+
+## obj serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy
+
+
+
+### fn serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy.new
+
+```ts
+new()
+```
+
+
+`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.canary.custom_canary_deployment.phase_configs.predeploy.new` constructs a new object with attributes and blocks configured for the `predeploy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the predeploy job. When `null`, the `actions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predeploy` sub block.
+
+
 ## obj serial_pipeline.stages.strategy.canary.runtime_config
 
 
@@ -652,11 +772,59 @@ Terraform sub block.
 
 **Args**:
   - `verify` (`bool`): Whether to verify a deployment. When `null`, the `verify` field will be omitted from the resulting object.
+  - `postdeploy` (`list[obj]`): Optional. Configuration for the postdeploy job. If this is not configured, postdeploy job will not be present. When `null`, the `postdeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.postdeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategypostdeploynew) constructor.
+  - `predeploy` (`list[obj]`): Optional. Configuration for the predeploy job. If this is not configured, predeploy job will not be present. When `null`, the `predeploy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.predeploy.new](#fn-serial_pipelineserial_pipelinestagesstrategypredeploynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `standard` sub block.
 
 
+## obj serial_pipeline.stages.strategy.standard.postdeploy
+
+
+
+### fn serial_pipeline.stages.strategy.standard.postdeploy.new
+
+```ts
+new()
+```
+
+
+`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.postdeploy.new` constructs a new object with attributes and blocks configured for the `postdeploy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the postdeploy job. When `null`, the `actions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `postdeploy` sub block.
+
+
+## obj serial_pipeline.stages.strategy.standard.predeploy
+
+
+
+### fn serial_pipeline.stages.strategy.standard.predeploy.new
+
+```ts
+new()
+```
+
+
+`google.clouddeploy_delivery_pipeline.serial_pipeline.stages.strategy.standard.predeploy.new` constructs a new object with attributes and blocks configured for the `predeploy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `actions` (`list`): Optional. A sequence of skaffold custom actions to invoke during execution of the predeploy job. When `null`, the `actions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predeploy` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/clouddeploy_target.md b/docs/4.x/clouddeploy_target.md
index b81667cc..74e7ddcd 100644
--- a/docs/4.x/clouddeploy_target.md
+++ b/docs/4.x/clouddeploy_target.md
@@ -77,10 +77,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.
   - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -114,10 +120,16 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.
   - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/clouddomains_registration.md b/docs/4.x/clouddomains_registration.md
new file mode 100644
index 00000000..53494b8d
--- /dev/null
+++ b/docs/4.x/clouddomains_registration.md
@@ -0,0 +1,850 @@
+---
+permalink: /clouddomains_registration/
+---
+
+# clouddomains_registration
+
+`clouddomains_registration` represents the `google_clouddomains_registration` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withContactNotices()`](#fn-withcontactnotices)
+* [`fn withContactSettings()`](#fn-withcontactsettings)
+* [`fn withContactSettingsMixin()`](#fn-withcontactsettingsmixin)
+* [`fn withDnsSettings()`](#fn-withdnssettings)
+* [`fn withDnsSettingsMixin()`](#fn-withdnssettingsmixin)
+* [`fn withDomainName()`](#fn-withdomainname)
+* [`fn withDomainNotices()`](#fn-withdomainnotices)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withManagementSettings()`](#fn-withmanagementsettings)
+* [`fn withManagementSettingsMixin()`](#fn-withmanagementsettingsmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withYearlyPrice()`](#fn-withyearlyprice)
+* [`fn withYearlyPriceMixin()`](#fn-withyearlypricemixin)
+* [`obj contact_settings`](#obj-contact_settings)
+  * [`fn new()`](#fn-contact_settingsnew)
+  * [`obj contact_settings.admin_contact`](#obj-contact_settingsadmin_contact)
+    * [`fn new()`](#fn-contact_settingsadmin_contactnew)
+    * [`obj contact_settings.admin_contact.postal_address`](#obj-contact_settingsadmin_contactpostal_address)
+      * [`fn new()`](#fn-contact_settingsadmin_contactpostal_addressnew)
+  * [`obj contact_settings.registrant_contact`](#obj-contact_settingsregistrant_contact)
+    * [`fn new()`](#fn-contact_settingsregistrant_contactnew)
+    * [`obj contact_settings.registrant_contact.postal_address`](#obj-contact_settingsregistrant_contactpostal_address)
+      * [`fn new()`](#fn-contact_settingsregistrant_contactpostal_addressnew)
+  * [`obj contact_settings.technical_contact`](#obj-contact_settingstechnical_contact)
+    * [`fn new()`](#fn-contact_settingstechnical_contactnew)
+    * [`obj contact_settings.technical_contact.postal_address`](#obj-contact_settingstechnical_contactpostal_address)
+      * [`fn new()`](#fn-contact_settingstechnical_contactpostal_addressnew)
+* [`obj dns_settings`](#obj-dns_settings)
+  * [`fn new()`](#fn-dns_settingsnew)
+  * [`obj dns_settings.custom_dns`](#obj-dns_settingscustom_dns)
+    * [`fn new()`](#fn-dns_settingscustom_dnsnew)
+    * [`obj dns_settings.custom_dns.ds_records`](#obj-dns_settingscustom_dnsds_records)
+      * [`fn new()`](#fn-dns_settingscustom_dnsds_recordsnew)
+  * [`obj dns_settings.glue_records`](#obj-dns_settingsglue_records)
+    * [`fn new()`](#fn-dns_settingsglue_recordsnew)
+* [`obj management_settings`](#obj-management_settings)
+  * [`fn new()`](#fn-management_settingsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj yearly_price`](#obj-yearly_price)
+  * [`fn new()`](#fn-yearly_pricenew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.new` injects a new `google_clouddomains_registration` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.clouddomains_registration.new('some_id')
+
+You can get the reference to the `id` field of the created `google.clouddomains_registration` using the reference:
+
+    $._ref.google_clouddomains_registration.some_id.get('id')
+
+This is the same as directly entering `"${ google_clouddomains_registration.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `contact_notices` (`list`): The list of contact notices that the caller acknowledges. Possible value is PUBLIC_CONTACT_DATA_ACKNOWLEDGEMENT When `null`, the `contact_notices` field will be omitted from the resulting object.
+  - `domain_name` (`string`): Required. The domain name. Unicode domain names must be expressed in Punycode format.
+  - `domain_notices` (`list`): The list of domain notices that you acknowledge. Possible value is HSTS_PRELOADED When `null`, the `domain_notices` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of labels associated with the Registration.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location for the resource
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `contact_settings` (`list[obj]`): Required. Settings for contact information linked to the Registration. When `null`, the `contact_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.new](#fn-contact_settingsnew) constructor.
+  - `dns_settings` (`list[obj]`): Settings controlling the DNS configuration of the Registration. When `null`, the `dns_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.new](#fn-dns_settingsnew) constructor.
+  - `management_settings` (`list[obj]`): Settings for management of the Registration, including renewal, billing, and transfer When `null`, the `management_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.management_settings.new](#fn-management_settingsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.timeouts.new](#fn-timeoutsnew) constructor.
+  - `yearly_price` (`list[obj]`): Required. Yearly price to register or renew the domain. The value that should be put here can be obtained from
+registrations.retrieveRegisterParameters or registrations.searchDomains calls. When `null`, the `yearly_price` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.yearly_price.new](#fn-yearly_pricenew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.clouddomains_registration.newAttrs` constructs a new object with attributes and blocks configured for the `clouddomains_registration`
+Terraform resource.
+
+Unlike [google.clouddomains_registration.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `contact_notices` (`list`): The list of contact notices that the caller acknowledges. Possible value is PUBLIC_CONTACT_DATA_ACKNOWLEDGEMENT When `null`, the `contact_notices` field will be omitted from the resulting object.
+  - `domain_name` (`string`): Required. The domain name. Unicode domain names must be expressed in Punycode format.
+  - `domain_notices` (`list`): The list of domain notices that you acknowledge. Possible value is HSTS_PRELOADED When `null`, the `domain_notices` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of labels associated with the Registration.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location for the resource
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `contact_settings` (`list[obj]`): Required. Settings for contact information linked to the Registration. When `null`, the `contact_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.new](#fn-contact_settingsnew) constructor.
+  - `dns_settings` (`list[obj]`): Settings controlling the DNS configuration of the Registration. When `null`, the `dns_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.new](#fn-dns_settingsnew) constructor.
+  - `management_settings` (`list[obj]`): Settings for management of the Registration, including renewal, billing, and transfer When `null`, the `management_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.management_settings.new](#fn-management_settingsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.timeouts.new](#fn-timeoutsnew) constructor.
+  - `yearly_price` (`list[obj]`): Required. Yearly price to register or renew the domain. The value that should be put here can be obtained from
+registrations.retrieveRegisterParameters or registrations.searchDomains calls. When `null`, the `yearly_price` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.yearly_price.new](#fn-yearly_pricenew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddomains_registration` resource into the root Terraform configuration.
+
+
+### fn withContactNotices
+
+```ts
+withContactNotices()
+```
+
+`google.list.withContactNotices` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the contact_notices field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `contact_notices` field.
+
+
+### fn withContactSettings
+
+```ts
+withContactSettings()
+```
+
+`google.list[obj].withContactSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the contact_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withContactSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `contact_settings` field.
+
+
+### fn withContactSettingsMixin
+
+```ts
+withContactSettingsMixin()
+```
+
+`google.list[obj].withContactSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the contact_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withContactSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `contact_settings` field.
+
+
+### fn withDnsSettings
+
+```ts
+withDnsSettings()
+```
+
+`google.list[obj].withDnsSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dns_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDnsSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dns_settings` field.
+
+
+### fn withDnsSettingsMixin
+
+```ts
+withDnsSettingsMixin()
+```
+
+`google.list[obj].withDnsSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dns_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDnsSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dns_settings` field.
+
+
+### fn withDomainName
+
+```ts
+withDomainName()
+```
+
+`google.string.withDomainName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the domain_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `domain_name` field.
+
+
+### fn withDomainNotices
+
+```ts
+withDomainNotices()
+```
+
+`google.list.withDomainNotices` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the domain_notices field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `domain_notices` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withManagementSettings
+
+```ts
+withManagementSettings()
+```
+
+`google.list[obj].withManagementSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the management_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withManagementSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `management_settings` field.
+
+
+### fn withManagementSettingsMixin
+
+```ts
+withManagementSettingsMixin()
+```
+
+`google.list[obj].withManagementSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the management_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withManagementSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `management_settings` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withYearlyPrice
+
+```ts
+withYearlyPrice()
+```
+
+`google.list[obj].withYearlyPrice` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the yearly_price field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withYearlyPriceMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `yearly_price` field.
+
+
+### fn withYearlyPriceMixin
+
+```ts
+withYearlyPriceMixin()
+```
+
+`google.list[obj].withYearlyPriceMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the yearly_price field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withYearlyPrice](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `yearly_price` field.
+
+
+## obj contact_settings
+
+
+
+### fn contact_settings.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.new` constructs a new object with attributes and blocks configured for the `contact_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `privacy` (`string`): Required. Privacy setting for the contacts associated with the Registration.
+Values are PUBLIC_CONTACT_DATA, PRIVATE_CONTACT_DATA, and REDACTED_CONTACT_DATA
+  - `admin_contact` (`list[obj]`): Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.
+
+Warning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to
+avoid domain suspension. When `null`, the `admin_contact` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.admin_contact.new](#fn-contact_settingsadmin_contactnew) constructor.
+  - `registrant_contact` (`list[obj]`): Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.
+
+Warning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to
+avoid domain suspension. When `null`, the `registrant_contact` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.registrant_contact.new](#fn-contact_settingsregistrant_contactnew) constructor.
+  - `technical_contact` (`list[obj]`): Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.
+
+Warning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to
+avoid domain suspension. When `null`, the `technical_contact` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.technical_contact.new](#fn-contact_settingstechnical_contactnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `contact_settings` sub block.
+
+
+## obj contact_settings.admin_contact
+
+
+
+### fn contact_settings.admin_contact.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.admin_contact.new` constructs a new object with attributes and blocks configured for the `admin_contact`
+Terraform sub block.
+
+
+
+**Args**:
+  - `email` (`string`): Required. Email address of the contact.
+  - `fax_number` (`string`): Fax number of the contact in international format. For example, "+1-800-555-0123". When `null`, the `fax_number` field will be omitted from the resulting object.
+  - `phone_number` (`string`): Required. Phone number of the contact in international format. For example, "+1-800-555-0123".
+  - `postal_address` (`list[obj]`): Required. Postal address of the contact. When `null`, the `postal_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.admin_contact.postal_address.new](#fn-contact_settingscontact_settingspostal_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `admin_contact` sub block.
+
+
+## obj contact_settings.admin_contact.postal_address
+
+
+
+### fn contact_settings.admin_contact.postal_address.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.admin_contact.postal_address.new` constructs a new object with attributes and blocks configured for the `postal_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_lines` (`list`): Unstructured address lines describing the lower levels of an address.
+Because values in addressLines do not have type information and may sometimes contain multiple values in a single
+field (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be
+"envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language
+is used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way,
+the most specific line of an address can be selected based on the language. When `null`, the `address_lines` field will be omitted from the resulting object.
+  - `administrative_area` (`string`): Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state,
+a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community
+(e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland
+this should be left unpopulated. When `null`, the `administrative_area` field will be omitted from the resulting object.
+  - `locality` (`string`): Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world
+where localities are not well defined or do not fit into this structure well, leave locality empty and use addressLines. When `null`, the `locality` field will be omitted from the resulting object.
+  - `organization` (`string`): The name of the organization at the address. When `null`, the `organization` field will be omitted from the resulting object.
+  - `postal_code` (`string`): Postal code of the address. Not all countries use or require postal codes to be present, but where they are used,
+they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.). When `null`, the `postal_code` field will be omitted from the resulting object.
+  - `recipients` (`list`): The recipient at the address. This field may, under certain circumstances, contain multiline information. For example,
+it might contain "care of" information. When `null`, the `recipients` field will be omitted from the resulting object.
+  - `region_code` (`string`): Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to
+ensure the value is correct. See https://cldr.unicode.org/ and
+https://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.
+
+**Returns**:
+  - An attribute object that represents the `postal_address` sub block.
+
+
+## obj contact_settings.registrant_contact
+
+
+
+### fn contact_settings.registrant_contact.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.registrant_contact.new` constructs a new object with attributes and blocks configured for the `registrant_contact`
+Terraform sub block.
+
+
+
+**Args**:
+  - `email` (`string`): Required. Email address of the contact.
+  - `fax_number` (`string`): Fax number of the contact in international format. For example, "+1-800-555-0123". When `null`, the `fax_number` field will be omitted from the resulting object.
+  - `phone_number` (`string`): Required. Phone number of the contact in international format. For example, "+1-800-555-0123".
+  - `postal_address` (`list[obj]`): Required. Postal address of the contact. When `null`, the `postal_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.registrant_contact.postal_address.new](#fn-contact_settingscontact_settingspostal_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `registrant_contact` sub block.
+
+
+## obj contact_settings.registrant_contact.postal_address
+
+
+
+### fn contact_settings.registrant_contact.postal_address.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.registrant_contact.postal_address.new` constructs a new object with attributes and blocks configured for the `postal_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_lines` (`list`): Unstructured address lines describing the lower levels of an address.
+Because values in addressLines do not have type information and may sometimes contain multiple values in a single
+field (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be
+"envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language
+is used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way,
+the most specific line of an address can be selected based on the language. When `null`, the `address_lines` field will be omitted from the resulting object.
+  - `administrative_area` (`string`): Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state,
+a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community
+(e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland
+this should be left unpopulated. When `null`, the `administrative_area` field will be omitted from the resulting object.
+  - `locality` (`string`): Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world
+where localities are not well defined or do not fit into this structure well, leave locality empty and use addressLines. When `null`, the `locality` field will be omitted from the resulting object.
+  - `organization` (`string`): The name of the organization at the address. When `null`, the `organization` field will be omitted from the resulting object.
+  - `postal_code` (`string`): Postal code of the address. Not all countries use or require postal codes to be present, but where they are used,
+they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.). When `null`, the `postal_code` field will be omitted from the resulting object.
+  - `recipients` (`list`): The recipient at the address. This field may, under certain circumstances, contain multiline information. For example,
+it might contain "care of" information. When `null`, the `recipients` field will be omitted from the resulting object.
+  - `region_code` (`string`): Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to
+ensure the value is correct. See https://cldr.unicode.org/ and
+https://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.
+
+**Returns**:
+  - An attribute object that represents the `postal_address` sub block.
+
+
+## obj contact_settings.technical_contact
+
+
+
+### fn contact_settings.technical_contact.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.technical_contact.new` constructs a new object with attributes and blocks configured for the `technical_contact`
+Terraform sub block.
+
+
+
+**Args**:
+  - `email` (`string`): Required. Email address of the contact.
+  - `fax_number` (`string`): Fax number of the contact in international format. For example, "+1-800-555-0123". When `null`, the `fax_number` field will be omitted from the resulting object.
+  - `phone_number` (`string`): Required. Phone number of the contact in international format. For example, "+1-800-555-0123".
+  - `postal_address` (`list[obj]`): Required. Postal address of the contact. When `null`, the `postal_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.contact_settings.technical_contact.postal_address.new](#fn-contact_settingscontact_settingspostal_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `technical_contact` sub block.
+
+
+## obj contact_settings.technical_contact.postal_address
+
+
+
+### fn contact_settings.technical_contact.postal_address.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.contact_settings.technical_contact.postal_address.new` constructs a new object with attributes and blocks configured for the `postal_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_lines` (`list`): Unstructured address lines describing the lower levels of an address.
+Because values in addressLines do not have type information and may sometimes contain multiple values in a single
+field (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be
+"envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language
+is used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way,
+the most specific line of an address can be selected based on the language. When `null`, the `address_lines` field will be omitted from the resulting object.
+  - `administrative_area` (`string`): Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state,
+a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community
+(e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland
+this should be left unpopulated. When `null`, the `administrative_area` field will be omitted from the resulting object.
+  - `locality` (`string`): Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world
+where localities are not well defined or do not fit into this structure well, leave locality empty and use addressLines. When `null`, the `locality` field will be omitted from the resulting object.
+  - `organization` (`string`): The name of the organization at the address. When `null`, the `organization` field will be omitted from the resulting object.
+  - `postal_code` (`string`): Postal code of the address. Not all countries use or require postal codes to be present, but where they are used,
+they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.). When `null`, the `postal_code` field will be omitted from the resulting object.
+  - `recipients` (`list`): The recipient at the address. This field may, under certain circumstances, contain multiline information. For example,
+it might contain "care of" information. When `null`, the `recipients` field will be omitted from the resulting object.
+  - `region_code` (`string`): Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to
+ensure the value is correct. See https://cldr.unicode.org/ and
+https://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.
+
+**Returns**:
+  - An attribute object that represents the `postal_address` sub block.
+
+
+## obj dns_settings
+
+
+
+### fn dns_settings.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.dns_settings.new` constructs a new object with attributes and blocks configured for the `dns_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `custom_dns` (`list[obj]`): Configuration for an arbitrary DNS provider. When `null`, the `custom_dns` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.custom_dns.new](#fn-dns_settingscustom_dnsnew) constructor.
+  - `glue_records` (`list[obj]`): The list of glue records for this Registration. Commonly empty. When `null`, the `glue_records` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.glue_records.new](#fn-dns_settingsglue_recordsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `dns_settings` sub block.
+
+
+## obj dns_settings.custom_dns
+
+
+
+### fn dns_settings.custom_dns.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.dns_settings.custom_dns.new` constructs a new object with attributes and blocks configured for the `custom_dns`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name_servers` (`list`): Required. A list of name servers that store the DNS zone for this domain. Each name server is a domain
+name, with Unicode domain names expressed in Punycode format.
+  - `ds_records` (`list[obj]`): The list of DS records for this domain, which are used to enable DNSSEC. The domain's DNS provider can provide
+the values to set here. If this field is empty, DNSSEC is disabled. When `null`, the `ds_records` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddomains_registration.dns_settings.custom_dns.ds_records.new](#fn-dns_settingsdns_settingsds_recordsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_dns` sub block.
+
+
+## obj dns_settings.custom_dns.ds_records
+
+
+
+### fn dns_settings.custom_dns.ds_records.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.dns_settings.custom_dns.ds_records.new` constructs a new object with attributes and blocks configured for the `ds_records`
+Terraform sub block.
+
+
+
+**Args**:
+  - `algorithm` (`string`): The algorithm used to generate the referenced DNSKEY. When `null`, the `algorithm` field will be omitted from the resulting object.
+  - `digest` (`string`): The digest generated from the referenced DNSKEY. When `null`, the `digest` field will be omitted from the resulting object.
+  - `digest_type` (`string`): The hash function used to generate the digest of the referenced DNSKEY. When `null`, the `digest_type` field will be omitted from the resulting object.
+  - `key_tag` (`number`): The key tag of the record. Must be set in range 0 -- 65535. When `null`, the `key_tag` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ds_records` sub block.
+
+
+## obj dns_settings.glue_records
+
+
+
+### fn dns_settings.glue_records.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.dns_settings.glue_records.new` constructs a new object with attributes and blocks configured for the `glue_records`
+Terraform sub block.
+
+
+
+**Args**:
+  - `host_name` (`string`): Required. Domain name of the host in Punycode format.
+  - `ipv4_addresses` (`list`): List of IPv4 addresses corresponding to this host in the standard decimal format (e.g. 198.51.100.1).
+At least one of ipv4_address and ipv6_address must be set. When `null`, the `ipv4_addresses` field will be omitted from the resulting object.
+  - `ipv6_addresses` (`list`): List of IPv4 addresses corresponding to this host in the standard decimal format (e.g. 198.51.100.1).
+At least one of ipv4_address and ipv6_address must be set. When `null`, the `ipv6_addresses` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `glue_records` sub block.
+
+
+## obj management_settings
+
+
+
+### fn management_settings.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.management_settings.new` constructs a new object with attributes and blocks configured for the `management_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `preferred_renewal_method` (`string`): The desired renewal method for this Registration. The actual renewalMethod is automatically updated to reflect this choice.
+If unset or equal to RENEWAL_METHOD_UNSPECIFIED, the actual renewalMethod is treated as if it were set to AUTOMATIC_RENEWAL.
+You cannot use RENEWAL_DISABLED during resource creation, and you can update the renewal status only when the Registration
+resource has state ACTIVE or SUSPENDED.
+
+When preferredRenewalMethod is set to AUTOMATIC_RENEWAL, the actual renewalMethod can be set to RENEWAL_DISABLED in case of
+problems with the billing account or reported domain abuse. In such cases, check the issues field on the Registration. After
+the problem is resolved, the renewalMethod is automatically updated to preferredRenewalMethod in a few hours. When `null`, the `preferred_renewal_method` field will be omitted from the resulting object.
+  - `transfer_lock_state` (`string`): Controls whether the domain can be transferred to another registrar. Values are UNLOCKED or LOCKED. When `null`, the `transfer_lock_state` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `management_settings` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj yearly_price
+
+
+
+### fn yearly_price.new
+
+```ts
+new()
+```
+
+
+`google.clouddomains_registration.yearly_price.new` constructs a new object with attributes and blocks configured for the `yearly_price`
+Terraform sub block.
+
+
+
+**Args**:
+  - `currency_code` (`string`): The three-letter currency code defined in ISO 4217. When `null`, the `currency_code` field will be omitted from the resulting object.
+  - `units` (`string`): The whole units of the amount. For example if currencyCode is "USD", then 1 unit is one US dollar. When `null`, the `units` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `yearly_price` sub block.
diff --git a/docs/4.x/cloudfunctions2_function.md b/docs/4.x/cloudfunctions2_function.md
index c02528fe..0d68b5ba 100644
--- a/docs/4.x/cloudfunctions2_function.md
+++ b/docs/4.x/cloudfunctions2_function.md
@@ -84,8 +84,12 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.
 It must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of this cloud function.
   - `name` (`string`): A user-defined name of the function. Function names must
 be unique globally and match pattern 'projects/*/locations/*/functions/*'.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -121,8 +125,12 @@ injecting into a complete block.
   - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.
 It must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of this cloud function.
   - `name` (`string`): A user-defined name of the function. Function names must
 be unique globally and match pattern 'projects/*/locations/*/functions/*'.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -516,7 +524,9 @@ Terraform sub block.
 as the transport topic for the event delivery. When `null`, the `pubsub_topic` field will be omitted from the resulting object.
   - `retry_policy` (`string`): Describes the retry policy in case of function's execution failure.
 Retried execution is charged as any other execution. Possible values: ["RETRY_POLICY_UNSPECIFIED", "RETRY_POLICY_DO_NOT_RETRY", "RETRY_POLICY_RETRY"] When `null`, the `retry_policy` field will be omitted from the resulting object.
-  - `service_account_email` (`string`): The email of the service account for this function. When `null`, the `service_account_email` field will be omitted from the resulting object.
+  - `service_account_email` (`string`): Optional. The email of the trigger's service account. The service account
+must have permission to invoke Cloud Run services. If empty, defaults to the
+Compute Engine default service account: {project_number}-compute@developer.gserviceaccount.com. When `null`, the `service_account_email` field will be omitted from the resulting object.
   - `trigger_region` (`string`): The region that the trigger will be in. The trigger will only receive
 events originating in this region. It can be the same
 region as the function, a different region or multi-region, or the global
diff --git a/docs/4.x/cloudfunctions_function.md b/docs/4.x/cloudfunctions_function.md
index 9fb8488e..e85d2a46 100644
--- a/docs/4.x/cloudfunctions_function.md
+++ b/docs/4.x/cloudfunctions_function.md
@@ -107,7 +107,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.
   - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.
   - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the function. Function names must be unique globally.
@@ -161,7 +164,10 @@ injecting into a complete block.
   - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.
   - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.
   - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the function. Function names must be unique globally.
diff --git a/docs/4.x/cloudiot_device.md b/docs/4.x/cloudiot_device.md
deleted file mode 100644
index f1fa710f..00000000
--- a/docs/4.x/cloudiot_device.md
+++ /dev/null
@@ -1,395 +0,0 @@
----
-permalink: /cloudiot_device/
----
-
-# cloudiot_device
-
-`cloudiot_device` represents the `google_cloudiot_device` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withBlocked()`](#fn-withblocked)
-* [`fn withCredentials()`](#fn-withcredentials)
-* [`fn withCredentialsMixin()`](#fn-withcredentialsmixin)
-* [`fn withGatewayConfig()`](#fn-withgatewayconfig)
-* [`fn withGatewayConfigMixin()`](#fn-withgatewayconfigmixin)
-* [`fn withLogLevel()`](#fn-withloglevel)
-* [`fn withMetadata()`](#fn-withmetadata)
-* [`fn withName()`](#fn-withname)
-* [`fn withRegistry()`](#fn-withregistry)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj credentials`](#obj-credentials)
-  * [`fn new()`](#fn-credentialsnew)
-  * [`obj credentials.public_key`](#obj-credentialspublic_key)
-    * [`fn new()`](#fn-credentialspublic_keynew)
-* [`obj gateway_config`](#obj-gateway_config)
-  * [`fn new()`](#fn-gateway_confignew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.new` injects a new `google_cloudiot_device` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.cloudiot_device.new('some_id')
-
-You can get the reference to the `id` field of the created `google.cloudiot_device` using the reference:
-
-    $._ref.google_cloudiot_device.some_id.get('id')
-
-This is the same as directly entering `"${ google_cloudiot_device.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.
-  - `log_level` (`string`): The logging verbosity for device activity. Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource.
-  - `registry` (`string`): The name of the device registry where this device should be created.
-  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.
-  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.cloudiot_device.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_device`
-Terraform resource.
-
-Unlike [google.cloudiot_device.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.
-  - `log_level` (`string`): The logging verbosity for device activity. Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource.
-  - `registry` (`string`): The name of the device registry where this device should be created.
-  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.
-  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_device` resource into the root Terraform configuration.
-
-
-### fn withBlocked
-
-```ts
-withBlocked()
-```
-
-`google.bool.withBlocked` constructs a mixin object that can be merged into the `bool`
-Terraform resource block to set or update the blocked field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`bool`): The value to set for the `blocked` field.
-
-
-### fn withCredentials
-
-```ts
-withCredentials()
-```
-
-`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withCredentialsMixin
-
-```ts
-withCredentialsMixin()
-```
-
-`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withGatewayConfig
-
-```ts
-withGatewayConfig()
-```
-
-`google.list[obj].withGatewayConfig` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the gateway_config field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withGatewayConfigMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `gateway_config` field.
-
-
-### fn withGatewayConfigMixin
-
-```ts
-withGatewayConfigMixin()
-```
-
-`google.list[obj].withGatewayConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the gateway_config field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withGatewayConfig](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `gateway_config` field.
-
-
-### fn withLogLevel
-
-```ts
-withLogLevel()
-```
-
-`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the log_level field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `log_level` field.
-
-
-### fn withMetadata
-
-```ts
-withMetadata()
-```
-
-`google.obj.withMetadata` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the metadata field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `metadata` field.
-
-
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
-
-
-### fn withRegistry
-
-```ts
-withRegistry()
-```
-
-`google.string.withRegistry` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the registry field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `registry` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj credentials
-
-
-
-### fn credentials.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`
-Terraform sub block.
-
-
-
-**Args**:
-  - `expiration_time` (`string`): The time at which this credential becomes invalid. When `null`, the `expiration_time` field will be omitted from the resulting object.
-  - `public_key` (`list[obj]`): A public key used to verify the signature of JSON Web Tokens (JWTs). When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.public_key.new](#fn-credentialspublic_keynew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `credentials` sub block.
-
-
-## obj credentials.public_key
-
-
-
-### fn credentials.public_key.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.credentials.public_key.new` constructs a new object with attributes and blocks configured for the `public_key`
-Terraform sub block.
-
-
-
-**Args**:
-  - `format` (`string`): The format of the key. Possible values: ["RSA_PEM", "RSA_X509_PEM", "ES256_PEM", "ES256_X509_PEM"]
-  - `key` (`string`): The key data.
-
-**Returns**:
-  - An attribute object that represents the `public_key` sub block.
-
-
-## obj gateway_config
-
-
-
-### fn gateway_config.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.gateway_config.new` constructs a new object with attributes and blocks configured for the `gateway_config`
-Terraform sub block.
-
-
-
-**Args**:
-  - `gateway_auth_method` (`string`): Indicates whether the device is a gateway. Possible values: ["ASSOCIATION_ONLY", "DEVICE_AUTH_TOKEN_ONLY", "ASSOCIATION_AND_DEVICE_AUTH_TOKEN"] When `null`, the `gateway_auth_method` field will be omitted from the resulting object.
-  - `gateway_type` (`string`): Indicates whether the device is a gateway. Default value: "NON_GATEWAY" Possible values: ["GATEWAY", "NON_GATEWAY"] When `null`, the `gateway_type` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `gateway_config` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/cloudiot_registry.md b/docs/4.x/cloudiot_registry.md
deleted file mode 100644
index f8f91901..00000000
--- a/docs/4.x/cloudiot_registry.md
+++ /dev/null
@@ -1,422 +0,0 @@
----
-permalink: /cloudiot_registry/
----
-
-# cloudiot_registry
-
-`cloudiot_registry` represents the `google_cloudiot_registry` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withCredentials()`](#fn-withcredentials)
-* [`fn withCredentialsMixin()`](#fn-withcredentialsmixin)
-* [`fn withEventNotificationConfigs()`](#fn-witheventnotificationconfigs)
-* [`fn withEventNotificationConfigsMixin()`](#fn-witheventnotificationconfigsmixin)
-* [`fn withHttpConfig()`](#fn-withhttpconfig)
-* [`fn withLogLevel()`](#fn-withloglevel)
-* [`fn withMqttConfig()`](#fn-withmqttconfig)
-* [`fn withName()`](#fn-withname)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
-* [`fn withStateNotificationConfig()`](#fn-withstatenotificationconfig)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj credentials`](#obj-credentials)
-  * [`fn new()`](#fn-credentialsnew)
-* [`obj event_notification_configs`](#obj-event_notification_configs)
-  * [`fn new()`](#fn-event_notification_configsnew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.new` injects a new `google_cloudiot_registry` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.cloudiot_registry.new('some_id')
-
-You can get the reference to the `id` field of the created `google.cloudiot_registry` using the reference:
-
-    $._ref.google_cloudiot_registry.some_id.get('id')
-
-This is the same as directly entering `"${ google_cloudiot_registry.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.
-  - `log_level` (`string`): The default logging verbosity for activity from devices in this
-registry. Specifies which events should be written to logs. For
-example, if the LogLevel is ERROR, only events that terminate in
-errors will be logged. LogLevel is inclusive; enabling INFO logging
-will also enable ERROR logging. Default value: "NONE" Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource, required by device registry.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): The region in which the created registry should reside.
-If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
-  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.
-  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.
-  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics
-to publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.cloudiot_registry.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry`
-Terraform resource.
-
-Unlike [google.cloudiot_registry.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.
-  - `log_level` (`string`): The default logging verbosity for activity from devices in this
-registry. Specifies which events should be written to logs. For
-example, if the LogLevel is ERROR, only events that terminate in
-errors will be logged. LogLevel is inclusive; enabling INFO logging
-will also enable ERROR logging. Default value: "NONE" Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource, required by device registry.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): The region in which the created registry should reside.
-If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
-  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.
-  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.
-  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics
-to publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry` resource into the root Terraform configuration.
-
-
-### fn withCredentials
-
-```ts
-withCredentials()
-```
-
-`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withCredentialsMixin
-
-```ts
-withCredentialsMixin()
-```
-
-`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withEventNotificationConfigs
-
-```ts
-withEventNotificationConfigs()
-```
-
-`google.list[obj].withEventNotificationConfigs` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the event_notification_configs field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withEventNotificationConfigsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.
-
-
-### fn withEventNotificationConfigsMixin
-
-```ts
-withEventNotificationConfigsMixin()
-```
-
-`google.list[obj].withEventNotificationConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the event_notification_configs field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withEventNotificationConfigs](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.
-
-
-### fn withHttpConfig
-
-```ts
-withHttpConfig()
-```
-
-`google.obj.withHttpConfig` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the http_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `http_config` field.
-
-
-### fn withLogLevel
-
-```ts
-withLogLevel()
-```
-
-`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the log_level field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `log_level` field.
-
-
-### fn withMqttConfig
-
-```ts
-withMqttConfig()
-```
-
-`google.obj.withMqttConfig` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the mqtt_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `mqtt_config` field.
-
-
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRegion
-
-```ts
-withRegion()
-```
-
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
-
-
-### fn withStateNotificationConfig
-
-```ts
-withStateNotificationConfig()
-```
-
-`google.obj.withStateNotificationConfig` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the state_notification_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `state_notification_config` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj credentials
-
-
-
-### fn credentials.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`
-Terraform sub block.
-
-
-
-**Args**:
-  - `public_key_certificate` (`obj`): A public key certificate format and data.
-
-**Returns**:
-  - An attribute object that represents the `credentials` sub block.
-
-
-## obj event_notification_configs
-
-
-
-### fn event_notification_configs.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.event_notification_configs.new` constructs a new object with attributes and blocks configured for the `event_notification_configs`
-Terraform sub block.
-
-
-
-**Args**:
-  - `pubsub_topic_name` (`string`): PubSub topic name to publish device events.
-  - `subfolder_matches` (`string`): If the subfolder name matches this string exactly, this
-configuration will be used. The string must not include the
-leading '/' character. If empty, all strings are matched. Empty
-value can only be used for the last 'event_notification_configs'
-item. When `null`, the `subfolder_matches` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `event_notification_configs` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/composer_environment.md b/docs/4.x/composer_environment.md
index 81ed5e7f..dfd700f7 100644
--- a/docs/4.x/composer_environment.md
+++ b/docs/4.x/composer_environment.md
@@ -21,10 +21,16 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRegion()`](#fn-withregion)
+* [`fn withStorageConfig()`](#fn-withstorageconfig)
+* [`fn withStorageConfigMixin()`](#fn-withstorageconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj config`](#obj-config)
   * [`fn new()`](#fn-confignew)
+  * [`obj config.data_retention_config`](#obj-configdata_retention_config)
+    * [`fn new()`](#fn-configdata_retention_confignew)
+    * [`obj config.data_retention_config.task_logs_retention_config`](#obj-configdata_retention_configtask_logs_retention_config)
+      * [`fn new()`](#fn-configdata_retention_configtask_logs_retention_confignew)
   * [`obj config.database_config`](#obj-configdatabase_config)
     * [`fn new()`](#fn-configdatabase_confignew)
   * [`obj config.encryption_config`](#obj-configencryption_config)
@@ -55,10 +61,14 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-configworkloads_confignew)
     * [`obj config.workloads_config.scheduler`](#obj-configworkloads_configscheduler)
       * [`fn new()`](#fn-configworkloads_configschedulernew)
+    * [`obj config.workloads_config.triggerer`](#obj-configworkloads_configtriggerer)
+      * [`fn new()`](#fn-configworkloads_configtriggerernew)
     * [`obj config.workloads_config.web_server`](#obj-configworkloads_configweb_server)
       * [`fn new()`](#fn-configworkloads_configweb_servernew)
     * [`obj config.workloads_config.worker`](#obj-configworkloads_configworker)
       * [`fn new()`](#fn-configworkloads_configworkernew)
+* [`obj storage_config`](#obj-storage_config)
+  * [`fn new()`](#fn-storage_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -91,11 +101,15 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the environment.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.
   - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.
+  - `storage_config` (`list[obj]`): Configuration options for storage used by Composer environment. When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.storage_config.new](#fn-storage_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -120,11 +134,15 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the environment.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.
   - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.
+  - `storage_config` (`list[obj]`): Configuration options for storage used by Composer environment. When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.storage_config.new](#fn-storage_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -232,6 +250,43 @@ Terraform resource block to set or update the region field.
   - `value` (`string`): The value to set for the `region` field.
 
 
+### fn withStorageConfig
+
+```ts
+withStorageConfig()
+```
+
+`google.list[obj].withStorageConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage_config` field.
+
+
+### fn withStorageConfigMixin
+
+```ts
+withStorageConfigMixin()
+```
+
+`google.list[obj].withStorageConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorageConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -288,6 +343,7 @@ Terraform sub block.
   - `environment_size` (`string`): The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. When `null`, the `environment_size` field will be omitted from the resulting object.
   - `node_count` (`number`): The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `node_count` field will be omitted from the resulting object.
   - `resilience_mode` (`string`): Whether high resilience is enabled or not. This field is supported for Cloud Composer environments in versions composer-2.1.15-airflow-*.*.* and newer. When `null`, the `resilience_mode` field will be omitted from the resulting object.
+  - `data_retention_config` (`list[obj]`): The configuration setting for Airflow data retention mechanism. This field is supported for Cloud Composer environments in versions composer-2.0.32-airflow-2.1.4. or newer When `null`, the `data_retention_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.data_retention_config.new](#fn-configdata_retention_confignew) constructor.
   - `database_config` (`list[obj]`): The configuration of Cloud SQL instance that is used by the Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `database_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.database_config.new](#fn-configdatabase_confignew) constructor.
   - `encryption_config` (`list[obj]`): The encryption options for the Composer environment and its dependencies. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.encryption_config.new](#fn-configencryption_confignew) constructor.
   - `maintenance_window` (`list[obj]`): The configuration for Cloud Composer maintenance window. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.maintenance_window.new](#fn-configmaintenance_windownew) constructor.
@@ -297,13 +353,59 @@ Terraform sub block.
   - `recovery_config` (`list[obj]`): The recovery configuration settings for the Cloud Composer environment When `null`, the `recovery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.recovery_config.new](#fn-configrecovery_confignew) constructor.
   - `software_config` (`list[obj]`): The configuration settings for software inside the environment. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.software_config.new](#fn-configsoftware_confignew) constructor.
   - `web_server_config` (`list[obj]`): The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `web_server_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_config.new](#fn-configweb_server_confignew) constructor.
-  - `web_server_network_access_control` (`list[obj]`): The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. When `null`, the `web_server_network_access_control` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_network_access_control.new](#fn-configweb_server_network_access_controlnew) constructor.
+  - `web_server_network_access_control` (`list[obj]`): Network-level access control policy for the Airflow web server. When `null`, the `web_server_network_access_control` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.web_server_network_access_control.new](#fn-configweb_server_network_access_controlnew) constructor.
   - `workloads_config` (`list[obj]`): The workloads configuration settings for the GKE cluster associated with the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. When `null`, the `workloads_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.new](#fn-configworkloads_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `config` sub block.
 
 
+## obj config.data_retention_config
+
+
+
+### fn config.data_retention_config.new
+
+```ts
+new()
+```
+
+
+`google.composer_environment.config.data_retention_config.new` constructs a new object with attributes and blocks configured for the `data_retention_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `task_logs_retention_config` (`list[obj]`): Optional. The configuration setting for Task Logs. When `null`, the `task_logs_retention_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.data_retention_config.task_logs_retention_config.new](#fn-configconfigtask_logs_retention_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `data_retention_config` sub block.
+
+
+## obj config.data_retention_config.task_logs_retention_config
+
+
+
+### fn config.data_retention_config.task_logs_retention_config.new
+
+```ts
+new()
+```
+
+
+`google.composer_environment.config.data_retention_config.task_logs_retention_config.new` constructs a new object with attributes and blocks configured for the `task_logs_retention_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `storage_mode` (`string`): Whether logs in cloud logging only is enabled or not. This field is supported for Cloud Composer environments in versions composer-2.0.32-airflow-2.1.4 and newer. When `null`, the `storage_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `task_logs_retention_config` sub block.
+
+
 ## obj config.database_config
 
 
@@ -321,7 +423,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `machine_type` (`string`): Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
+  - `machine_type` (`string`): Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used. When `null`, the `machine_type` field will be omitted from the resulting object.
+  - `zone` (`string`): Optional. Cloud SQL database preferred zone. When `null`, the `zone` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `database_config` sub block.
@@ -650,6 +753,7 @@ Terraform sub block.
 
 **Args**:
   - `scheduler` (`list[obj]`): Configuration for resources used by Airflow schedulers. When `null`, the `scheduler` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.scheduler.new](#fn-configconfigschedulernew) constructor.
+  - `triggerer` (`list[obj]`): Configuration for resources used by Airflow triggerers. When `null`, the `triggerer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.triggerer.new](#fn-configconfigtriggerernew) constructor.
   - `web_server` (`list[obj]`): Configuration for resources used by Airflow web server. When `null`, the `web_server` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.web_server.new](#fn-configconfigweb_servernew) constructor.
   - `worker` (`list[obj]`): Configuration for resources used by Airflow workers. When `null`, the `worker` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.worker.new](#fn-configconfigworkernew) constructor.
 
@@ -683,6 +787,31 @@ Terraform sub block.
   - An attribute object that represents the `scheduler` sub block.
 
 
+## obj config.workloads_config.triggerer
+
+
+
+### fn config.workloads_config.triggerer.new
+
+```ts
+new()
+```
+
+
+`google.composer_environment.config.workloads_config.triggerer.new` constructs a new object with attributes and blocks configured for the `triggerer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `count` (`number`): The number of triggerers.
+  - `cpu` (`number`): CPU request and limit for a single Airflow triggerer replica.
+  - `memory_gb` (`number`): Memory (GB) request and limit for a single Airflow triggerer replica.
+
+**Returns**:
+  - An attribute object that represents the `triggerer` sub block.
+
+
 ## obj config.workloads_config.web_server
 
 
@@ -735,6 +864,29 @@ Terraform sub block.
   - An attribute object that represents the `worker` sub block.
 
 
+## obj storage_config
+
+
+
+### fn storage_config.new
+
+```ts
+new()
+```
+
+
+`google.composer_environment.storage_config.new` constructs a new object with attributes and blocks configured for the `storage_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bucket` (`string`): Optional. Name of an existing Cloud Storage bucket to be used by the environment.
+
+**Returns**:
+  - An attribute object that represents the `storage_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_address.md b/docs/4.x/compute_address.md
index 0011a1d2..eccb87dc 100644
--- a/docs/4.x/compute_address.md
+++ b/docs/4.x/compute_address.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withIpVersion()`](#fn-withipversion)
 * [`fn withIpv6EndpointType()`](#fn-withipv6endpointtype)
+* [`fn withLabels()`](#fn-withlabels)
 * [`fn withName()`](#fn-withname)
 * [`fn withNetwork()`](#fn-withnetwork)
 * [`fn withNetworkTier()`](#fn-withnetworktier)
@@ -72,6 +73,11 @@ Note: if you set this argument's value as 'INTERNAL' you need to lea
   - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is
 used for deciding which type of endpoint this address can be used after
 the external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this address.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and
 comply with RFC1035. Specifically, the name must be 1-63 characters
 long and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'
@@ -146,6 +152,11 @@ Note: if you set this argument's value as 'INTERNAL' you need to lea
   - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is
 used for deciding which type of endpoint this address can be used after
 the external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this address.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and
 comply with RFC1035. Specifically, the name must be 1-63 characters
 long and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'
@@ -272,6 +283,22 @@ Terraform resource block to set or update the ipv6_endpoint_type field.
   - `value` (`string`): The value to set for the `ipv6_endpoint_type` field.
 
 
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
 ### fn withName
 
 ```ts
@@ -455,6 +482,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/compute_backend_service.md b/docs/4.x/compute_backend_service.md
index f57393ab..bd0d1681 100644
--- a/docs/4.x/compute_backend_service.md
+++ b/docs/4.x/compute_backend_service.md
@@ -250,8 +250,8 @@ validateForProxyless field set to true. When `null`, the `locality_lb_policies`
   - `log_config` (`list[obj]`): This field denotes the logging options for the load balancer traffic served by this backend service.
 If logging is enabled, logs will be exported to Stackdriver. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.log_config.new](#fn-log_confignew) constructor.
   - `outlier_detection` (`list[obj]`): Settings controlling eviction of unhealthy hosts from the load balancing pool.
-This field is applicable only when the load_balancing_scheme is set
-to INTERNAL_SELF_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.
+Applicable backend service types can be a global backend service with the
+loadBalancingScheme set to INTERNAL_SELF_MANAGED or EXTERNAL_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.
   - `security_settings` (`list[obj]`): The security settings that apply to this backend service. This field is applicable to either
 a regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and
 load_balancing_scheme set to INTERNAL_MANAGED; or a global backend service with the
@@ -409,8 +409,8 @@ validateForProxyless field set to true. When `null`, the `locality_lb_policies`
   - `log_config` (`list[obj]`): This field denotes the logging options for the load balancer traffic served by this backend service.
 If logging is enabled, logs will be exported to Stackdriver. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.log_config.new](#fn-log_confignew) constructor.
   - `outlier_detection` (`list[obj]`): Settings controlling eviction of unhealthy hosts from the load balancing pool.
-This field is applicable only when the load_balancing_scheme is set
-to INTERNAL_SELF_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.
+Applicable backend service types can be a global backend service with the
+loadBalancingScheme set to INTERNAL_SELF_MANAGED or EXTERNAL_MANAGED. When `null`, the `outlier_detection` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_backend_service.outlier_detection.new](#fn-outlier_detectionnew) constructor.
   - `security_settings` (`list[obj]`): The security settings that apply to this backend service. This field is applicable to either
 a regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and
 load_balancing_scheme set to INTERNAL_MANAGED; or a global backend service with the
diff --git a/docs/4.x/compute_disk.md b/docs/4.x/compute_disk.md
index 484c5c64..9e2fb6ed 100644
--- a/docs/4.x/compute_disk.md
+++ b/docs/4.x/compute_disk.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDiskEncryptionKey()`](#fn-withdiskencryptionkey)
 * [`fn withDiskEncryptionKeyMixin()`](#fn-withdiskencryptionkeymixin)
+* [`fn withEnableConfidentialCompute()`](#fn-withenableconfidentialcompute)
 * [`fn withGuestOsFeatures()`](#fn-withguestosfeatures)
 * [`fn withGuestOsFeaturesMixin()`](#fn-withguestosfeaturesmixin)
 * [`fn withImage()`](#fn-withimage)
@@ -85,6 +86,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `enable_confidential_compute` (`bool`): Whether this disk is using confidential compute mode.
+Note: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.
   - `image` (`string`): The image from which to initialize this disk. This can be
 one of: the image's 'self_link', 'projects/{project}/global/images/{image}',
 'projects/{project}/global/images/family/{family}', 'global/images/{image}',
@@ -94,7 +97,11 @@ images names must include the family name. If they don't, use the
 [google_compute_image data source](/docs/providers/google/d/compute_image.html).
 For instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.
 These images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -195,6 +202,8 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `enable_confidential_compute` (`bool`): Whether this disk is using confidential compute mode.
+Note: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.
   - `image` (`string`): The image from which to initialize this disk. This can be
 one of: the image's 'self_link', 'projects/{project}/global/images/{image}',
 'projects/{project}/global/images/family/{family}', 'global/images/{image}',
@@ -204,7 +213,11 @@ images names must include the family name. If they don't, use the
 [google_compute_image data source](/docs/providers/google/d/compute_image.html).
 For instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.
 These images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -375,6 +388,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `disk_encryption_key` field.
 
 
+### fn withEnableConfidentialCompute
+
+```ts
+withEnableConfidentialCompute()
+```
+
+`google.bool.withEnableConfidentialCompute` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_confidential_compute field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_confidential_compute` field.
+
+
 ### fn withGuestOsFeatures
 
 ```ts
diff --git a/docs/4.x/compute_external_vpn_gateway.md b/docs/4.x/compute_external_vpn_gateway.md
index 372c3cda..7d64d699 100644
--- a/docs/4.x/compute_external_vpn_gateway.md
+++ b/docs/4.x/compute_external_vpn_gateway.md
@@ -59,7 +59,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for the external VPN gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035.  Specifically, the name must be 1-63 characters long and
@@ -95,7 +98,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for the external VPN gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035.  Specifically, the name must be 1-63 characters long and
diff --git a/docs/4.x/compute_forwarding_rule.md b/docs/4.x/compute_forwarding_rule.md
index a3d26fd4..d17dab3e 100644
--- a/docs/4.x/compute_forwarding_rule.md
+++ b/docs/4.x/compute_forwarding_rule.md
@@ -33,6 +33,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withPortRange()`](#fn-withportrange)
 * [`fn withPorts()`](#fn-withports)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withRecreateClosedPsc()`](#fn-withrecreateclosedpsc)
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withServiceDirectoryRegistrations()`](#fn-withservicedirectoryregistrations)
 * [`fn withServiceDirectoryRegistrationsMixin()`](#fn-withservicedirectoryregistrationsmixin)
@@ -76,21 +77,21 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `all_ports` (`bool`): This field can only be used:
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, and internal and external protocol forwarding.
-
-This option should be set to TRUE when the Forwarding Rule
-IPProtocol is set to L3_DEFAULT.
-
-Set this field to true to allow packets addressed to any port or packets
+  - `all_ports` (`bool`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'allPorts' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, SCTP, or
+L3_DEFAULT.
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal and external protocol forwarding.
+* Set this field to true to allow packets addressed to any port or packets
 lacking destination port information (for example, UDP fragments after the
 first fragment) to be forwarded to the backends configured with this
-forwarding rule.
-
-The 'ports', 'port_range', and
-'allPorts' fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.
+forwarding rule. The L3_DEFAULT protocol requires 'allPorts' be set to
+true. When `null`, the `all_ports` field will be omitted from the resulting object.
   - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for
 internal load balancing or with the 'target' field for internal
 TargetInstance.
@@ -172,7 +173,11 @@ load balancer will not have their traffic mirrored even if a
 
 This can only be set to true for load balancers that have their
 'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -212,51 +217,54 @@ If this field is not specified, it is assumed to be 'PREMIUM'.
 If 'IPAddress' is specified, this value must be equal to the
 networkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
-
-Only packets addressed to ports in the specified range will be forwarded to
-the backends configured with this forwarding rule.
-
-The 'ports' and 'port_range' fields are mutually exclusive.
-
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot have
-overlapping 'portRange's.
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot have overlapping 'portRange's. When `null`, the `port_range` field will be omitted from the resulting object.
-  - `ports` (`list`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, internal protocol forwarding and when protocol is not L3_DEFAULT.
-
-
-You can specify a list of up to five ports by number, separated by commas.
-The ports can be contiguous or discontiguous. Only packets addressed to
-these ports will be forwarded to the backends configured with this
-forwarding rule.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
+
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
+  - `ports` (`list`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'ports' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal protocol forwarding.
+* You can specify a list of up to five ports by number, separated by
+commas. The ports can be contiguous or discontiguous.
 
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot share any values
-defined in 'ports'.
+same '[IPAddress, IPProtocol]' pair if they share at least one port
+number.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot share any values defined in 'ports'.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair if
+they share at least one port number.
 
-The 'ports' and 'port_range' fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `ports` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.
   - `region` (`string`): A reference to the region where the regional forwarding rule resides.
 
 This field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.
@@ -320,21 +328,21 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `all_ports` (`bool`): This field can only be used:
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, and internal and external protocol forwarding.
-
-This option should be set to TRUE when the Forwarding Rule
-IPProtocol is set to L3_DEFAULT.
-
-Set this field to true to allow packets addressed to any port or packets
+  - `all_ports` (`bool`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'allPorts' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, SCTP, or
+L3_DEFAULT.
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal and external protocol forwarding.
+* Set this field to true to allow packets addressed to any port or packets
 lacking destination port information (for example, UDP fragments after the
 first fragment) to be forwarded to the backends configured with this
-forwarding rule.
-
-The 'ports', 'port_range', and
-'allPorts' fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.
+forwarding rule. The L3_DEFAULT protocol requires 'allPorts' be set to
+true. When `null`, the `all_ports` field will be omitted from the resulting object.
   - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for
 internal load balancing or with the 'target' field for internal
 TargetInstance.
@@ -416,7 +424,11 @@ load balancer will not have their traffic mirrored even if a
 
 This can only be set to true for load balancers that have their
 'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -456,51 +468,54 @@ If this field is not specified, it is assumed to be 'PREMIUM'.
 If 'IPAddress' is specified, this value must be equal to the
 networkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
-
-Only packets addressed to ports in the specified range will be forwarded to
-the backends configured with this forwarding rule.
-
-The 'ports' and 'port_range' fields are mutually exclusive.
-
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot have
-overlapping 'portRange's.
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot have overlapping 'portRange's. When `null`, the `port_range` field will be omitted from the resulting object.
-  - `ports` (`list`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, internal protocol forwarding and when protocol is not L3_DEFAULT.
-
-
-You can specify a list of up to five ports by number, separated by commas.
-The ports can be contiguous or discontiguous. Only packets addressed to
-these ports will be forwarded to the backends configured with this
-forwarding rule.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
+
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
+  - `ports` (`list`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'ports' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal protocol forwarding.
+* You can specify a list of up to five ports by number, separated by
+commas. The ports can be contiguous or discontiguous.
 
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot share any values
-defined in 'ports'.
+same '[IPAddress, IPProtocol]' pair if they share at least one port
+number.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot share any values defined in 'ports'.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair if
+they share at least one port number.
 
-The 'ports' and 'port_range' fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `ports` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.
   - `region` (`string`): A reference to the region where the regional forwarding rule resides.
 
 This field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.
@@ -834,6 +849,22 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withRecreateClosedPsc
+
+```ts
+withRecreateClosedPsc()
+```
+
+`google.bool.withRecreateClosedPsc` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the recreate_closed_psc field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `recreate_closed_psc` field.
+
+
 ### fn withRegion
 
 ```ts
diff --git a/docs/4.x/compute_global_forwarding_rule.md b/docs/4.x/compute_global_forwarding_rule.md
index 15227055..17cf710e 100644
--- a/docs/4.x/compute_global_forwarding_rule.md
+++ b/docs/4.x/compute_global_forwarding_rule.md
@@ -28,6 +28,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withNoAutomateDnsZone()`](#fn-withnoautomatednszone)
 * [`fn withPortRange()`](#fn-withportrange)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withServiceDirectoryRegistrations()`](#fn-withservicedirectoryregistrations)
+* [`fn withServiceDirectoryRegistrationsMixin()`](#fn-withservicedirectoryregistrationsmixin)
 * [`fn withSourceIpRanges()`](#fn-withsourceipranges)
 * [`fn withSubnetwork()`](#fn-withsubnetwork)
 * [`fn withTarget()`](#fn-withtarget)
@@ -37,6 +39,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-metadata_filtersnew)
   * [`obj metadata_filters.filter_labels`](#obj-metadata_filtersfilter_labels)
     * [`fn new()`](#fn-metadata_filtersfilter_labelsnew)
+* [`obj service_directory_registrations`](#obj-service_directory_registrations)
+  * [`fn new()`](#fn-service_directory_registrationsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -122,7 +126,11 @@ The valid IP protocols are different for different load balancing products
 as described in [Load balancing
 features](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.
   - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -151,24 +159,26 @@ be used.
 For Private Service Connect forwarding rules that forward traffic to Google
 APIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
+For external forwarding rules, two or more forwarding rules cannot use the
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
+
+For internal forwarding rules within the same VPC network, two or more
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
 
-* TargetHttpProxy: 80, 8080
-* TargetHttpsProxy: 443
-* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.
   - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should
@@ -208,6 +218,9 @@ the UrlMap that this ForwardingRule references.
 
 metadataFilters only applies to Loadbalancers that have their
 loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.
+  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.
+
+Currently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -285,7 +298,11 @@ The valid IP protocols are different for different load balancing products
 as described in [Load balancing
 features](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.
   - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -314,24 +331,26 @@ be used.
 For Private Service Connect forwarding rules that forward traffic to Google
 APIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
+For external forwarding rules, two or more forwarding rules cannot use the
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
+
+For internal forwarding rules within the same VPC network, two or more
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
 
-* TargetHttpProxy: 80, 8080
-* TargetHttpsProxy: 443
-* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.
   - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should
@@ -371,6 +390,9 @@ the UrlMap that this ForwardingRule references.
 
 metadataFilters only applies to Loadbalancers that have their
 loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.
+  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.
+
+Currently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -590,6 +612,43 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withServiceDirectoryRegistrations
+
+```ts
+withServiceDirectoryRegistrations()
+```
+
+`google.list[obj].withServiceDirectoryRegistrations` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the service_directory_registrations field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withServiceDirectoryRegistrationsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `service_directory_registrations` field.
+
+
+### fn withServiceDirectoryRegistrationsMixin
+
+```ts
+withServiceDirectoryRegistrationsMixin()
+```
+
+`google.list[obj].withServiceDirectoryRegistrationsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the service_directory_registrations field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withServiceDirectoryRegistrations](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `service_directory_registrations` field.
+
+
 ### fn withSourceIpRanges
 
 ```ts
@@ -733,6 +792,33 @@ length of 1024 characters.
   - An attribute object that represents the `filter_labels` sub block.
 
 
+## obj service_directory_registrations
+
+
+
+### fn service_directory_registrations.new
+
+```ts
+new()
+```
+
+
+`google.compute_global_forwarding_rule.service_directory_registrations.new` constructs a new object with attributes and blocks configured for the `service_directory_registrations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `namespace` (`string`): Service Directory namespace to register the forwarding rule under. When `null`, the `namespace` field will be omitted from the resulting object.
+  - `service_directory_region` (`string`): [Optional] Service Directory region to register this global forwarding rule under.
+Default to "us-central1". Only used for PSC for Google APIs. All PSC for
+Google APIs Forwarding Rules on the same network should use the same Service
+Directory region. When `null`, the `service_directory_region` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `service_directory_registrations` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_image.md b/docs/4.x/compute_image.md
index ea01ee09..d48bf252 100644
--- a/docs/4.x/compute_image.md
+++ b/docs/4.x/compute_image.md
@@ -80,7 +80,10 @@ create disks by specifying an image family instead of a specific
 image name. The image family always returns its latest image that is
 not deprecated. The name of the image family must comply with
 RFC1035. When `null`, the `family` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Image.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -152,7 +155,10 @@ create disks by specifying an image family instead of a specific
 image name. The image family always returns its latest image that is
 not deprecated. The name of the image family must comply with
 RFC1035. When `null`, the `family` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Image.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -538,7 +544,7 @@ Terraform sub block.
 
 
 **Args**:
-  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE"]
+  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE", "SEV_LIVE_MIGRATABLE_V2"]
 
 **Returns**:
   - An attribute object that represents the `guest_os_features` sub block.
diff --git a/docs/4.x/compute_instance.md b/docs/4.x/compute_instance.md
index 2281be8f..79db5d4c 100644
--- a/docs/4.x/compute_instance.md
+++ b/docs/4.x/compute_instance.md
@@ -137,7 +137,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -191,7 +194,10 @@ injecting into a complete block.
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -1085,8 +1091,11 @@ Terraform sub block.
 
 
 **Args**:
+  - `enable_confidential_compute` (`bool`): A flag to enable confidential compute mode on boot disk When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.
   - `image` (`string`): The image from which this disk was initialised. When `null`, the `image` field will be omitted from the resulting object.
   - `labels` (`obj`): A set of key/value label pairs assigned to the disk. When `null`, the `labels` field will be omitted from the resulting object.
+  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. When `null`, the `provisioned_iops` field will be omitted from the resulting object.
+  - `provisioned_throughput` (`number`): Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be between 1 and 7,124. When `null`, the `provisioned_throughput` field will be omitted from the resulting object.
   - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `size` (`number`): The size of the image in gigabytes. When `null`, the `size` field will be omitted from the resulting object.
   - `type` (`string`): The Google Compute Engine disk type. Such as pd-standard, pd-ssd or pd-balanced. When `null`, the `type` field will be omitted from the resulting object.
@@ -1425,6 +1434,7 @@ Terraform sub block.
 
 
 **Args**:
+  - `device_name` (`string`): Name with which the attached disk is accessible under /dev/disk/by-id/ When `null`, the `device_name` field will be omitted from the resulting object.
   - `interface` (`string`): The disk interface used for attaching this disk. One of SCSI or NVME.
   - `size` (`number`): The size of the disk in gigabytes. One of 375 or 3000. When `null`, the `size` field will be omitted from the resulting object.
 
diff --git a/docs/4.x/compute_instance_from_template.md b/docs/4.x/compute_instance_from_template.md
index b8177a71..b30dc08a 100644
--- a/docs/4.x/compute_instance_from_template.md
+++ b/docs/4.x/compute_instance_from_template.md
@@ -126,7 +126,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -181,7 +184,10 @@ injecting into a complete block.
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -1001,8 +1007,11 @@ Terraform sub block.
 
 
 **Args**:
+  - `enable_confidential_compute` (`bool`): A flag to enable confidential compute mode on boot disk When `null`, the `enable_confidential_compute` field will be omitted from the resulting object.
   - `image` (`string`): The image from which this disk was initialised. When `null`, the `image` field will be omitted from the resulting object.
   - `labels` (`obj`): A set of key/value label pairs assigned to the disk. When `null`, the `labels` field will be omitted from the resulting object.
+  - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. When `null`, the `provisioned_iops` field will be omitted from the resulting object.
+  - `provisioned_throughput` (`number`): Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be between 1 and 7,124. When `null`, the `provisioned_throughput` field will be omitted from the resulting object.
   - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `size` (`number`): The size of the image in gigabytes. When `null`, the `size` field will be omitted from the resulting object.
   - `type` (`string`): The Google Compute Engine disk type. Such as pd-standard, pd-ssd or pd-balanced. When `null`, the `type` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_instance_group_manager.md b/docs/4.x/compute_instance_group_manager.md
index 33ea6603..3f274b58 100644
--- a/docs/4.x/compute_instance_group_manager.md
+++ b/docs/4.x/compute_instance_group_manager.md
@@ -28,6 +28,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withStatefulDisk()`](#fn-withstatefuldisk)
 * [`fn withStatefulDiskMixin()`](#fn-withstatefuldiskmixin)
+* [`fn withStatefulExternalIp()`](#fn-withstatefulexternalip)
+* [`fn withStatefulExternalIpMixin()`](#fn-withstatefulexternalipmixin)
+* [`fn withStatefulInternalIp()`](#fn-withstatefulinternalip)
+* [`fn withStatefulInternalIpMixin()`](#fn-withstatefulinternalipmixin)
 * [`fn withTargetPools()`](#fn-withtargetpools)
 * [`fn withTargetSize()`](#fn-withtargetsize)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -47,6 +51,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-named_portnew)
 * [`obj stateful_disk`](#obj-stateful_disk)
   * [`fn new()`](#fn-stateful_disknew)
+* [`obj stateful_external_ip`](#obj-stateful_external_ip)
+  * [`fn new()`](#fn-stateful_external_ipnew)
+* [`obj stateful_internal_ip`](#obj-stateful_internal_ip)
+  * [`fn new()`](#fn-stateful_internal_ipnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 * [`obj update_policy`](#obj-update_policy)
@@ -99,6 +107,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -139,6 +149,8 @@ injecting into a complete block.
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -375,6 +387,80 @@ function.
   - `value` (`list[obj]`): The value to set for the `stateful_disk` field.
 
 
+### fn withStatefulExternalIp
+
+```ts
+withStatefulExternalIp()
+```
+
+`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulExternalIpMixin
+
+```ts
+withStatefulExternalIpMixin()
+```
+
+`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulInternalIp
+
+```ts
+withStatefulInternalIp()
+```
+
+`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
+### fn withStatefulInternalIpMixin
+
+```ts
+withStatefulInternalIpMixin()
+```
+
+`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
 ### fn withTargetPools
 
 ```ts
@@ -660,6 +746,54 @@ Terraform sub block.
   - An attribute object that represents the `stateful_disk` sub block.
 
 
+## obj stateful_external_ip
+
+
+
+### fn stateful_external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_external_ip` sub block.
+
+
+## obj stateful_internal_ip
+
+
+
+### fn stateful_internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_internal_ip` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_instance_template.md b/docs/4.x/compute_instance_template.md
index 45d20384..05fa6258 100644
--- a/docs/4.x/compute_instance_template.md
+++ b/docs/4.x/compute_instance_template.md
@@ -41,6 +41,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withReservationAffinity()`](#fn-withreservationaffinity)
 * [`fn withReservationAffinityMixin()`](#fn-withreservationaffinitymixin)
+* [`fn withResourceManagerTags()`](#fn-withresourcemanagertags)
 * [`fn withResourcePolicies()`](#fn-withresourcepolicies)
 * [`fn withScheduling()`](#fn-withscheduling)
 * [`fn withSchedulingMixin()`](#fn-withschedulingmixin)
@@ -124,7 +125,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -133,6 +137,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.
+  - `resource_manager_tags` (`obj`): A map of resource manager tags.
+				Resource manager tag keys and values have the same definition as resource manager tags.
+				Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456.
+				The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.
   - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.
@@ -172,7 +180,10 @@ injecting into a complete block.
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -181,6 +192,10 @@ injecting into a complete block.
   - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.
+  - `resource_manager_tags` (`obj`): A map of resource manager tags.
+				Resource manager tag keys and values have the same definition as resource manager tags.
+				Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456.
+				The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.
   - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.
@@ -650,6 +665,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `reservation_affinity` field.
 
 
+### fn withResourceManagerTags
+
+```ts
+withResourceManagerTags()
+```
+
+`google.obj.withResourceManagerTags` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the resource_manager_tags field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `resource_manager_tags` field.
+
+
 ### fn withResourcePolicies
 
 ```ts
@@ -904,6 +935,7 @@ Terraform sub block.
   - `labels` (`obj`): A set of key/value label pairs to assign to disks, When `null`, the `labels` field will be omitted from the resulting object.
   - `mode` (`string`): The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If you are attaching or creating a boot disk, this must read-write mode. When `null`, the `mode` field will be omitted from the resulting object.
   - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk). When `null`, the `provisioned_iops` field will be omitted from the resulting object.
+  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `resource_policies` (`list`): A list (short name or id) of resource policies to attach to this disk. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.
   - `source` (`string`): The name (not self_link) of the disk (such as those managed by google_compute_disk) to attach. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source` field will be omitted from the resulting object.
   - `source_image` (`string`): The image from which to initialize this disk. This can be one of: the image's self_link, projects/{project}/global/images/{image}, projects/{project}/global/images/family/{family}, global/images/{image}, global/images/family/{family}, family/{family}, {project}/{family}, {project}/{image}, {family}, or {image}. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source_image` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_interconnect_attachment.md b/docs/4.x/compute_interconnect_attachment.md
index 298b9ae6..d2a053b9 100644
--- a/docs/4.x/compute_interconnect_attachment.md
+++ b/docs/4.x/compute_interconnect_attachment.md
@@ -28,6 +28,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withRouter()`](#fn-withrouter)
+* [`fn withStackType()`](#fn-withstacktype)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withType()`](#fn-withtype)
@@ -133,6 +134,11 @@ letter, or digit, except the last character, which cannot be a dash.
 the same region as this InterconnectAttachment. The InterconnectAttachment will
 automatically connect the Interconnect to the network & region within which the
 Cloud Router is configured.
+  - `stack_type` (`string`): The stack type for this interconnect attachment to identify whether the IPv6
+feature is enabled or not. If not specified, IPV4_ONLY will be used.
+
+This field can be both set at interconnect attachments creation and update
+interconnect attachment operations. Possible values: ["IPV4_IPV6", "IPV4_ONLY"] When `null`, the `stack_type` field will be omitted from the resulting object.
   - `type` (`string`): The type of InterconnectAttachment you wish to create. Defaults to
 DEDICATED. Possible values: ["DEDICATED", "PARTNER", "PARTNER_PROVIDER"] When `null`, the `type` field will be omitted from the resulting object.
   - `vlan_tag8021q` (`number`): The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. When
@@ -230,6 +236,11 @@ letter, or digit, except the last character, which cannot be a dash.
 the same region as this InterconnectAttachment. The InterconnectAttachment will
 automatically connect the Interconnect to the network & region within which the
 Cloud Router is configured.
+  - `stack_type` (`string`): The stack type for this interconnect attachment to identify whether the IPv6
+feature is enabled or not. If not specified, IPV4_ONLY will be used.
+
+This field can be both set at interconnect attachments creation and update
+interconnect attachment operations. Possible values: ["IPV4_IPV6", "IPV4_ONLY"] When `null`, the `stack_type` field will be omitted from the resulting object.
   - `type` (`string`): The type of InterconnectAttachment you wish to create. Defaults to
 DEDICATED. Possible values: ["DEDICATED", "PARTNER", "PARTNER_PROVIDER"] When `null`, the `type` field will be omitted from the resulting object.
   - `vlan_tag8021q` (`number`): The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. When
@@ -448,6 +459,22 @@ Terraform resource block to set or update the router field.
   - `value` (`string`): The value to set for the `router` field.
 
 
+### fn withStackType
+
+```ts
+withStackType()
+```
+
+`google.string.withStackType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the stack_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `stack_type` field.
+
+
 ### fn withTimeouts
 
 ```ts
diff --git a/docs/4.x/compute_network_endpoint_group.md b/docs/4.x/compute_network_endpoint_group.md
index 9b9fdc21..cc580f77 100644
--- a/docs/4.x/compute_network_endpoint_group.md
+++ b/docs/4.x/compute_network_endpoint_group.md
@@ -78,7 +78,7 @@ that 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,
 INTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or
 CONNECTION balancing modes.
 
-Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
+Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT", "SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.
@@ -127,7 +127,7 @@ that 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,
 INTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or
 CONNECTION balancing modes.
 
-Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
+Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT", "SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_network_firewall_policy.md b/docs/4.x/compute_network_firewall_policy.md
index b403e623..59c2f17e 100644
--- a/docs/4.x/compute_network_firewall_policy.md
+++ b/docs/4.x/compute_network_firewall_policy.md
@@ -54,7 +54,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
-  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -81,7 +81,7 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
-  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
diff --git a/docs/4.x/compute_node_group.md b/docs/4.x/compute_node_group.md
index 2476442d..84d161ac 100644
--- a/docs/4.x/compute_node_group.md
+++ b/docs/4.x/compute_node_group.md
@@ -27,7 +27,6 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withShareSettings()`](#fn-withsharesettings)
 * [`fn withShareSettingsMixin()`](#fn-withsharesettingsmixin)
-* [`fn withSize()`](#fn-withsize)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withZone()`](#fn-withzone)
@@ -72,15 +71,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.
+  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.
   - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.
   - `node_template` (`string`): The URL of the node template to which this node group belongs.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `size` (`number`): The total number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `size` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.
   - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node
-group autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
+group autoscaler to automatically manage the sizes of your node groups.
+
+One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
   - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.
   - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.
@@ -108,15 +108,16 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.
+  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.
   - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.
   - `node_template` (`string`): The URL of the node template to which this node group belongs.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `size` (`number`): The total number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `size` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.
   - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node
-group autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
+group autoscaler to automatically manage the sizes of your node groups.
+
+One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
   - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.
   - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.
@@ -332,22 +333,6 @@ function.
   - `value` (`list[obj]`): The value to set for the `share_settings` field.
 
 
-### fn withSize
-
-```ts
-withSize()
-```
-
-`google.number.withSize` constructs a mixin object that can be merged into the `number`
-Terraform resource block to set or update the size field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`number`): The value to set for the `size` field.
-
-
 ### fn withTimeouts
 
 ```ts
diff --git a/docs/4.x/compute_per_instance_config.md b/docs/4.x/compute_per_instance_config.md
index 8ff0e892..74b47c79 100644
--- a/docs/4.x/compute_per_instance_config.md
+++ b/docs/4.x/compute_per_instance_config.md
@@ -22,6 +22,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withPreservedState()`](#fn-withpreservedstate)
 * [`fn withPreservedStateMixin()`](#fn-withpreservedstatemixin)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withRemoveInstanceOnDestroy()`](#fn-withremoveinstanceondestroy)
 * [`fn withRemoveInstanceStateOnDestroy()`](#fn-withremoveinstancestateondestroy)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
@@ -30,6 +31,14 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-preserved_statenew)
   * [`obj preserved_state.disk`](#obj-preserved_statedisk)
     * [`fn new()`](#fn-preserved_statedisknew)
+  * [`obj preserved_state.external_ip`](#obj-preserved_stateexternal_ip)
+    * [`fn new()`](#fn-preserved_stateexternal_ipnew)
+    * [`obj preserved_state.external_ip.ip_address`](#obj-preserved_stateexternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateexternal_ipip_addressnew)
+  * [`obj preserved_state.internal_ip`](#obj-preserved_stateinternal_ip)
+    * [`fn new()`](#fn-preserved_stateinternal_ipnew)
+    * [`obj preserved_state.internal_ip.ip_address`](#obj-preserved_stateinternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateinternal_ipip_addressnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -77,6 +86,8 @@ Default is 'REPLACE'. Possible values are:
 * NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.
   - `name` (`string`): The name for this per-instance config and its corresponding instance.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.
+When false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.
   - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.
 When false, deleting this config will *not* immediately remove any state from the underlying instance.
 State will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.
@@ -121,6 +132,8 @@ Default is 'REPLACE'. Possible values are:
 * NONE When `null`, the `most_disruptive_allowed_action` field will be omitted from the resulting object.
   - `name` (`string`): The name for this per-instance config and its corresponding instance.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.
+When false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.
   - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.
 When false, deleting this config will *not* immediately remove any state from the underlying instance.
 State will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.
@@ -249,6 +262,22 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withRemoveInstanceOnDestroy
+
+```ts
+withRemoveInstanceOnDestroy()
+```
+
+`google.bool.withRemoveInstanceOnDestroy` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the remove_instance_on_destroy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `remove_instance_on_destroy` field.
+
+
 ### fn withRemoveInstanceStateOnDestroy
 
 ```ts
@@ -336,6 +365,8 @@ Terraform sub block.
 **Args**:
   - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.
   - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.
+  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.
+  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `preserved_state` sub block.
@@ -372,6 +403,102 @@ deleted from the instance group. Default value: "NEVER" Possible values:
   - An attribute object that represents the `disk` sub block.
 
 
+## obj preserved_state.external_ip
+
+
+
+### fn preserved_state.external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `external_ip` sub block.
+
+
+## obj preserved_state.external_ip.ip_address
+
+
+
+### fn preserved_state.external_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
+## obj preserved_state.internal_ip
+
+
+
+### fn preserved_state.internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `internal_ip` sub block.
+
+
+## obj preserved_state.internal_ip.ip_address
+
+
+
+### fn preserved_state.internal_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_region_disk.md b/docs/4.x/compute_region_disk.md
index 03e082de..688828ea 100644
--- a/docs/4.x/compute_region_disk.md
+++ b/docs/4.x/compute_region_disk.md
@@ -79,7 +79,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -167,7 +171,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
diff --git a/docs/4.x/compute_region_instance_group_manager.md b/docs/4.x/compute_region_instance_group_manager.md
index 5ce6b902..27a149dc 100644
--- a/docs/4.x/compute_region_instance_group_manager.md
+++ b/docs/4.x/compute_region_instance_group_manager.md
@@ -31,6 +31,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withStatefulDisk()`](#fn-withstatefuldisk)
 * [`fn withStatefulDiskMixin()`](#fn-withstatefuldiskmixin)
+* [`fn withStatefulExternalIp()`](#fn-withstatefulexternalip)
+* [`fn withStatefulExternalIpMixin()`](#fn-withstatefulexternalipmixin)
+* [`fn withStatefulInternalIp()`](#fn-withstatefulinternalip)
+* [`fn withStatefulInternalIpMixin()`](#fn-withstatefulinternalipmixin)
 * [`fn withTargetPools()`](#fn-withtargetpools)
 * [`fn withTargetSize()`](#fn-withtargetsize)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -49,6 +53,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-named_portnew)
 * [`obj stateful_disk`](#obj-stateful_disk)
   * [`fn new()`](#fn-stateful_disknew)
+* [`obj stateful_external_ip`](#obj-stateful_external_ip)
+  * [`fn new()`](#fn-stateful_external_ipnew)
+* [`obj stateful_internal_ip`](#obj-stateful_internal_ip)
+  * [`fn new()`](#fn-stateful_internal_ipnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 * [`obj update_policy`](#obj-update_policy)
@@ -103,6 +111,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -145,6 +155,8 @@ injecting into a complete block.
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -429,6 +441,80 @@ function.
   - `value` (`list[obj]`): The value to set for the `stateful_disk` field.
 
 
+### fn withStatefulExternalIp
+
+```ts
+withStatefulExternalIp()
+```
+
+`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulExternalIpMixin
+
+```ts
+withStatefulExternalIpMixin()
+```
+
+`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulInternalIp
+
+```ts
+withStatefulInternalIp()
+```
+
+`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
+### fn withStatefulInternalIpMixin
+
+```ts
+withStatefulInternalIpMixin()
+```
+
+`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
 ### fn withTargetPools
 
 ```ts
@@ -698,6 +784,54 @@ Terraform sub block.
   - An attribute object that represents the `stateful_disk` sub block.
 
 
+## obj stateful_external_ip
+
+
+
+### fn stateful_external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_external_ip` sub block.
+
+
+## obj stateful_internal_ip
+
+
+
+### fn stateful_internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_internal_ip` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_region_instance_template.md b/docs/4.x/compute_region_instance_template.md
index 07bbfe99..a07d9956 100644
--- a/docs/4.x/compute_region_instance_template.md
+++ b/docs/4.x/compute_region_instance_template.md
@@ -41,6 +41,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withReservationAffinity()`](#fn-withreservationaffinity)
 * [`fn withReservationAffinityMixin()`](#fn-withreservationaffinitymixin)
+* [`fn withResourceManagerTags()`](#fn-withresourcemanagertags)
 * [`fn withResourcePolicies()`](#fn-withresourcepolicies)
 * [`fn withScheduling()`](#fn-withscheduling)
 * [`fn withSchedulingMixin()`](#fn-withschedulingmixin)
@@ -124,7 +125,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -133,6 +137,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
+  - `resource_manager_tags` (`obj`): A map of resource manager tags.
+				Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.
   - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.
@@ -172,7 +178,10 @@ injecting into a complete block.
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -181,6 +190,8 @@ injecting into a complete block.
   - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
+  - `resource_manager_tags` (`obj`): A map of resource manager tags.
+				Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.
   - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.
@@ -650,6 +661,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `reservation_affinity` field.
 
 
+### fn withResourceManagerTags
+
+```ts
+withResourceManagerTags()
+```
+
+`google.obj.withResourceManagerTags` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the resource_manager_tags field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `resource_manager_tags` field.
+
+
 ### fn withResourcePolicies
 
 ```ts
@@ -904,6 +931,7 @@ Terraform sub block.
   - `labels` (`obj`): A set of key/value label pairs to assign to disks, When `null`, the `labels` field will be omitted from the resulting object.
   - `mode` (`string`): The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If you are attaching or creating a boot disk, this must read-write mode. When `null`, the `mode` field will be omitted from the resulting object.
   - `provisioned_iops` (`number`): Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk). When `null`, the `provisioned_iops` field will be omitted from the resulting object.
+  - `resource_manager_tags` (`obj`): A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty. When `null`, the `resource_manager_tags` field will be omitted from the resulting object.
   - `resource_policies` (`list`): A list (short name or id) of resource policies to attach to this disk. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.
   - `source` (`string`): The name (not self_link) of the disk (such as those managed by google_compute_disk) to attach. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source` field will be omitted from the resulting object.
   - `source_image` (`string`): The image from which to initialize this disk. This can be one of: the image's self_link, projects/{project}/global/images/{image}, projects/{project}/global/images/family/{family}, global/images/{image}, global/images/family/{family}, family/{family}, {project}/{family}, {project}/{image}, {family}, or {image}. ~> Note: Either source or source_image is required when creating a new instance except for when creating a local SSD. When `null`, the `source_image` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_region_network_endpoint.md b/docs/4.x/compute_region_network_endpoint.md
new file mode 100644
index 00000000..188dcb42
--- /dev/null
+++ b/docs/4.x/compute_region_network_endpoint.md
@@ -0,0 +1,261 @@
+---
+permalink: /compute_region_network_endpoint/
+---
+
+# compute_region_network_endpoint
+
+`compute_region_network_endpoint` represents the `google_compute_region_network_endpoint` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withFqdn()`](#fn-withfqdn)
+* [`fn withIpAddress()`](#fn-withipaddress)
+* [`fn withPort()`](#fn-withport)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withRegionNetworkEndpointGroup()`](#fn-withregionnetworkendpointgroup)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.compute_region_network_endpoint.new` injects a new `google_compute_region_network_endpoint` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.compute_region_network_endpoint.new('some_id')
+
+You can get the reference to the `id` field of the created `google.compute_region_network_endpoint` using the reference:
+
+    $._ref.google_compute_region_network_endpoint.some_id.get('id')
+
+This is the same as directly entering `"${ google_compute_region_network_endpoint.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `fqdn` (`string`): Fully qualified domain name of network endpoint.
+
+This can only be specified when network_endpoint_type of the NEG is INTERNET_FQDN_PORT. When `null`, the `fqdn` field will be omitted from the resulting object.
+  - `ip_address` (`string`): IPv4 address external endpoint.
+
+This can only be specified when network_endpoint_type of the NEG is INTERNET_IP_PORT. When `null`, the `ip_address` field will be omitted from the resulting object.
+  - `port` (`number`): Port number of network endpoint.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): Region where the containing network endpoint group is located. When `null`, the `region` field will be omitted from the resulting object.
+  - `region_network_endpoint_group` (`string`): The network endpoint group this endpoint is part of.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.compute_region_network_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_network_endpoint`
+Terraform resource.
+
+Unlike [google.compute_region_network_endpoint.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `fqdn` (`string`): Fully qualified domain name of network endpoint.
+
+This can only be specified when network_endpoint_type of the NEG is INTERNET_FQDN_PORT. When `null`, the `fqdn` field will be omitted from the resulting object.
+  - `ip_address` (`string`): IPv4 address external endpoint.
+
+This can only be specified when network_endpoint_type of the NEG is INTERNET_IP_PORT. When `null`, the `ip_address` field will be omitted from the resulting object.
+  - `port` (`number`): Port number of network endpoint.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): Region where the containing network endpoint group is located. When `null`, the `region` field will be omitted from the resulting object.
+  - `region_network_endpoint_group` (`string`): The network endpoint group this endpoint is part of.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_network_endpoint` resource into the root Terraform configuration.
+
+
+### fn withFqdn
+
+```ts
+withFqdn()
+```
+
+`google.string.withFqdn` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the fqdn field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `fqdn` field.
+
+
+### fn withIpAddress
+
+```ts
+withIpAddress()
+```
+
+`google.string.withIpAddress` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the ip_address field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `ip_address` field.
+
+
+### fn withPort
+
+```ts
+withPort()
+```
+
+`google.number.withPort` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the port field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `port` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withRegionNetworkEndpointGroup
+
+```ts
+withRegionNetworkEndpointGroup()
+```
+
+`google.string.withRegionNetworkEndpointGroup` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region_network_endpoint_group field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region_network_endpoint_group` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_network_endpoint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/compute_region_network_endpoint_group.md b/docs/4.x/compute_region_network_endpoint_group.md
index 8c3ebe7d..a068ff7f 100644
--- a/docs/4.x/compute_region_network_endpoint_group.md
+++ b/docs/4.x/compute_region_network_endpoint_group.md
@@ -78,21 +78,28 @@ the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the
 first character must be a lowercase letter, and all following
 characters must be a dash, lowercase letter, or digit, except the last
 character, which cannot be a dash.
-  - `network` (`string`): This field is only used for PSC.
+  - `network` (`string`): This field is only used for PSC and INTERNET NEGs.
+
 The URL of the network to which all network endpoints in the NEG belong. Uses
 "default" project network if unspecified. When `null`, the `network` field will be omitted from the resulting object.
-  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS Default value: "SERVERLESS" Possible values: ["SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
+  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS. Default value: "SERVERLESS" Possible values: ["SERVERLESS", "PRIVATE_SERVICE_CONNECT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `psc_target_service` (`string`): The target service url used to set up private service connection to
+  - `psc_target_service` (`string`): This field is only used for PSC and INTERNET NEGs.
+
+The target service url used to set up private service connection to
 a Google API or a PSC Producer Service Attachment. When `null`, the `psc_target_service` field will be omitted from the resulting object.
-  - `region` (`string`): A reference to the region where the Serverless NEGs Reside.
-  - `subnetwork` (`string`): This field is only used for PSC.
+  - `region` (`string`): A reference to the region where the regional NEGs reside.
+  - `subnetwork` (`string`): This field is only used for PSC NEGs.
+
 Optional URL of the subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.
-  - `app_engine` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".
+  - `app_engine` (`list[obj]`): This field is only used for SERVERLESS NEGs.
+
 Only one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `app_engine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.app_engine.new](#fn-app_enginenew) constructor.
-  - `cloud_function` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".
+  - `cloud_function` (`list[obj]`): This field is only used for SERVERLESS NEGs.
+
 Only one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_function` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_function.new](#fn-cloud_functionnew) constructor.
-  - `cloud_run` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".
+  - `cloud_run` (`list[obj]`): This field is only used for SERVERLESS NEGs.
+
 Only one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_run.new](#fn-cloud_runnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -127,21 +134,28 @@ the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the
 first character must be a lowercase letter, and all following
 characters must be a dash, lowercase letter, or digit, except the last
 character, which cannot be a dash.
-  - `network` (`string`): This field is only used for PSC.
+  - `network` (`string`): This field is only used for PSC and INTERNET NEGs.
+
 The URL of the network to which all network endpoints in the NEG belong. Uses
 "default" project network if unspecified. When `null`, the `network` field will be omitted from the resulting object.
-  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS Default value: "SERVERLESS" Possible values: ["SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
+  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group. Defaults to SERVERLESS. Default value: "SERVERLESS" Possible values: ["SERVERLESS", "PRIVATE_SERVICE_CONNECT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `psc_target_service` (`string`): The target service url used to set up private service connection to
+  - `psc_target_service` (`string`): This field is only used for PSC and INTERNET NEGs.
+
+The target service url used to set up private service connection to
 a Google API or a PSC Producer Service Attachment. When `null`, the `psc_target_service` field will be omitted from the resulting object.
-  - `region` (`string`): A reference to the region where the Serverless NEGs Reside.
-  - `subnetwork` (`string`): This field is only used for PSC.
+  - `region` (`string`): A reference to the region where the regional NEGs reside.
+  - `subnetwork` (`string`): This field is only used for PSC NEGs.
+
 Optional URL of the subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.
-  - `app_engine` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".
+  - `app_engine` (`list[obj]`): This field is only used for SERVERLESS NEGs.
+
 Only one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `app_engine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.app_engine.new](#fn-app_enginenew) constructor.
-  - `cloud_function` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".
+  - `cloud_function` (`list[obj]`): This field is only used for SERVERLESS NEGs.
+
 Only one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_function` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_function.new](#fn-cloud_functionnew) constructor.
-  - `cloud_run` (`list[obj]`): Only valid when networkEndpointType is "SERVERLESS".
+  - `cloud_run` (`list[obj]`): This field is only used for SERVERLESS NEGs.
+
 Only one of cloud_run, app_engine, cloud_function or serverless_deployment may be set. When `null`, the `cloud_run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.cloud_run.new](#fn-cloud_runnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.
 
diff --git a/docs/4.x/compute_region_network_firewall_policy.md b/docs/4.x/compute_region_network_firewall_policy.md
index 85c04e70..f5598f15 100644
--- a/docs/4.x/compute_region_network_firewall_policy.md
+++ b/docs/4.x/compute_region_network_firewall_policy.md
@@ -55,8 +55,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
-  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): The location of this resource. When `null`, the `region` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region of this resource. When `null`, the `region` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -83,8 +83,8 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of this resource. Provide this property when you create the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `name` (`string`): User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
-  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): The location of this resource. When `null`, the `region` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region of this resource. When `null`, the `region` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_network_firewall_policy.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
diff --git a/docs/4.x/compute_region_per_instance_config.md b/docs/4.x/compute_region_per_instance_config.md
index 8a330a6d..9f888ca4 100644
--- a/docs/4.x/compute_region_per_instance_config.md
+++ b/docs/4.x/compute_region_per_instance_config.md
@@ -23,6 +23,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withRegionInstanceGroupManager()`](#fn-withregioninstancegroupmanager)
+* [`fn withRemoveInstanceOnDestroy()`](#fn-withremoveinstanceondestroy)
 * [`fn withRemoveInstanceStateOnDestroy()`](#fn-withremoveinstancestateondestroy)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
@@ -30,6 +31,14 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-preserved_statenew)
   * [`obj preserved_state.disk`](#obj-preserved_statedisk)
     * [`fn new()`](#fn-preserved_statedisknew)
+  * [`obj preserved_state.external_ip`](#obj-preserved_stateexternal_ip)
+    * [`fn new()`](#fn-preserved_stateexternal_ipnew)
+    * [`obj preserved_state.external_ip.ip_address`](#obj-preserved_stateexternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateexternal_ipip_addressnew)
+  * [`obj preserved_state.internal_ip`](#obj-preserved_stateinternal_ip)
+    * [`fn new()`](#fn-preserved_stateinternal_ipnew)
+    * [`obj preserved_state.internal_ip.ip_address`](#obj-preserved_stateinternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateinternal_ipip_addressnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -78,6 +87,8 @@ Default is 'REPLACE'. Possible values are:
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): Region where the containing instance group manager is located When `null`, the `region` field will be omitted from the resulting object.
   - `region_instance_group_manager` (`string`): The region instance group manager this instance config is part of.
+  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.
+When false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.
   - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.
 When false, deleting this config will *not* immediately remove any state from the underlying instance.
 State will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.
@@ -122,6 +133,8 @@ Default is 'REPLACE'. Possible values are:
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): Region where the containing instance group manager is located When `null`, the `region` field will be omitted from the resulting object.
   - `region_instance_group_manager` (`string`): The region instance group manager this instance config is part of.
+  - `remove_instance_on_destroy` (`bool`): When true, deleting this config will immediately remove the underlying instance.
+When false, deleting this config will use the behavior as determined by remove_instance_on_destroy. When `null`, the `remove_instance_on_destroy` field will be omitted from the resulting object.
   - `remove_instance_state_on_destroy` (`bool`): When true, deleting this config will immediately remove any specified state from the underlying instance.
 When false, deleting this config will *not* immediately remove any state from the underlying instance.
 State will be removed on the next instance recreation or update. When `null`, the `remove_instance_state_on_destroy` field will be omitted from the resulting object.
@@ -265,6 +278,22 @@ Terraform resource block to set or update the region_instance_group_manager fiel
   - `value` (`string`): The value to set for the `region_instance_group_manager` field.
 
 
+### fn withRemoveInstanceOnDestroy
+
+```ts
+withRemoveInstanceOnDestroy()
+```
+
+`google.bool.withRemoveInstanceOnDestroy` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the remove_instance_on_destroy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `remove_instance_on_destroy` field.
+
+
 ### fn withRemoveInstanceStateOnDestroy
 
 ```ts
@@ -336,6 +365,8 @@ Terraform sub block.
 **Args**:
   - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.
   - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.
+  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.
+  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `preserved_state` sub block.
@@ -372,6 +403,102 @@ deleted from the instance group. Default value: "NEVER" Possible values:
   - An attribute object that represents the `disk` sub block.
 
 
+## obj preserved_state.external_ip
+
+
+
+### fn preserved_state.external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `external_ip` sub block.
+
+
+## obj preserved_state.external_ip.ip_address
+
+
+
+### fn preserved_state.external_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
+## obj preserved_state.internal_ip
+
+
+
+### fn preserved_state.internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `internal_ip` sub block.
+
+
+## obj preserved_state.internal_ip.ip_address
+
+
+
+### fn preserved_state.internal_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_router_nat.md b/docs/4.x/compute_router_nat.md
index 55344632..1d3c29a3 100644
--- a/docs/4.x/compute_router_nat.md
+++ b/docs/4.x/compute_router_nat.md
@@ -89,8 +89,8 @@ If maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater tha
 If maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.
 
 Mutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.
-  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information
-see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
+  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.
+For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
   - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.
   - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.
 This field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.
@@ -99,7 +99,7 @@ This field can only be set when enableDynamicPortAllocation is enabled. When `nu
 comply with RFC1035.
   - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are
 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud
-Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]
+Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.
   - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption
 is set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -159,8 +159,8 @@ If maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater tha
 If maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.
 
 Mutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.
-  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information
-see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
+  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.
+For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
   - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.
   - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.
 This field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.
@@ -169,7 +169,7 @@ This field can only be set when enableDynamicPortAllocation is enabled. When `nu
 comply with RFC1035.
   - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are
 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud
-Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]
+Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.
   - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption
 is set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_router_peer.md b/docs/4.x/compute_router_peer.md
index e451adf5..3d387383 100644
--- a/docs/4.x/compute_router_peer.md
+++ b/docs/4.x/compute_router_peer.md
@@ -27,6 +27,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withInterface()`](#fn-withinterface)
 * [`fn withIpAddress()`](#fn-withipaddress)
 * [`fn withIpv6NexthopAddress()`](#fn-withipv6nexthopaddress)
+* [`fn withMd5AuthenticationKey()`](#fn-withmd5authenticationkey)
+* [`fn withMd5AuthenticationKeyMixin()`](#fn-withmd5authenticationkeymixin)
 * [`fn withName()`](#fn-withname)
 * [`fn withPeerAsn()`](#fn-withpeerasn)
 * [`fn withPeerIpAddress()`](#fn-withpeeripaddress)
@@ -41,6 +43,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-advertised_ip_rangesnew)
 * [`obj bfd`](#obj-bfd)
   * [`fn new()`](#fn-bfdnew)
+* [`obj md5_authentication_key`](#obj-md5_authentication_key)
+  * [`fn new()`](#fn-md5_authentication_keynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -130,6 +134,8 @@ is 'CUSTOM' and is advertised to all peers of the router. These IP
 ranges will be advertised in addition to any specified groups.
 Leave this field blank to advertise no custom IP ranges. When `null`, the `advertised_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.advertised_ip_ranges.new](#fn-advertised_ip_rangesnew) constructor.
   - `bfd` (`list[obj]`): BFD configuration for the BGP peering. When `null`, the `bfd` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.bfd.new](#fn-bfdnew) constructor.
+  - `md5_authentication_key` (`list[obj]`): Present if MD5 authentication is enabled for the peering. Must be the name
+of one of the entries in the Router.md5_authentication_keys. The field must comply with RFC1035. When `null`, the `md5_authentication_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.md5_authentication_key.new](#fn-md5_authentication_keynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -211,6 +217,8 @@ is 'CUSTOM' and is advertised to all peers of the router. These IP
 ranges will be advertised in addition to any specified groups.
 Leave this field blank to advertise no custom IP ranges. When `null`, the `advertised_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.advertised_ip_ranges.new](#fn-advertised_ip_rangesnew) constructor.
   - `bfd` (`list[obj]`): BFD configuration for the BGP peering. When `null`, the `bfd` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.bfd.new](#fn-bfdnew) constructor.
+  - `md5_authentication_key` (`list[obj]`): Present if MD5 authentication is enabled for the peering. Must be the name
+of one of the entries in the Router.md5_authentication_keys. The field must comply with RFC1035. When `null`, the `md5_authentication_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.md5_authentication_key.new](#fn-md5_authentication_keynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_peer.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -419,6 +427,43 @@ Terraform resource block to set or update the ipv6_nexthop_address field.
   - `value` (`string`): The value to set for the `ipv6_nexthop_address` field.
 
 
+### fn withMd5AuthenticationKey
+
+```ts
+withMd5AuthenticationKey()
+```
+
+`google.list[obj].withMd5AuthenticationKey` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the md5_authentication_key field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMd5AuthenticationKeyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `md5_authentication_key` field.
+
+
+### fn withMd5AuthenticationKeyMixin
+
+```ts
+withMd5AuthenticationKeyMixin()
+```
+
+`google.list[obj].withMd5AuthenticationKeyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the md5_authentication_key field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMd5AuthenticationKey](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `md5_authentication_key` field.
+
+
 ### fn withName
 
 ```ts
@@ -648,6 +693,31 @@ If set to 'DISABLED', BFD is disabled for this BGP peer. Possible values
   - An attribute object that represents the `bfd` sub block.
 
 
+## obj md5_authentication_key
+
+
+
+### fn md5_authentication_key.new
+
+```ts
+new()
+```
+
+
+`google.compute_router_peer.md5_authentication_key.new` constructs a new object with attributes and blocks configured for the `md5_authentication_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): Value of the key.
+  - `name` (`string`): [REQUIRED] Name used to identify the key.
+Must be unique within a router. Must be referenced by exactly one bgpPeer. Must comply with RFC1035.
+
+**Returns**:
+  - An attribute object that represents the `md5_authentication_key` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_service_attachment.md b/docs/4.x/compute_service_attachment.md
index c7236dec..2e7b977b 100644
--- a/docs/4.x/compute_service_attachment.md
+++ b/docs/4.x/compute_service_attachment.md
@@ -87,9 +87,7 @@ except the last character, which cannot be a dash.
   - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.
 
 If false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .
-If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.
-
-For newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
+If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
   - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.
   - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by
 this service attachment.
@@ -142,9 +140,7 @@ except the last character, which cannot be a dash.
   - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.
 
 If false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .
-If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.
-
-For newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
+If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
   - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.
   - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by
 this service attachment.
diff --git a/docs/4.x/compute_snapshot.md b/docs/4.x/compute_snapshot.md
index d482b744..17af0f7a 100644
--- a/docs/4.x/compute_snapshot.md
+++ b/docs/4.x/compute_snapshot.md
@@ -72,7 +72,10 @@ service owners who needs to create separate snapshot chains, for
 example, for chargeback tracking.  When you describe your snapshot
 resource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Snapshot.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035. Specifically, the name must be 1-63 characters long and match
@@ -131,7 +134,10 @@ service owners who needs to create separate snapshot chains, for
 example, for chargeback tracking.  When you describe your snapshot
 resource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Snapshot.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035. Specifically, the name must be 1-63 characters long and match
diff --git a/docs/4.x/compute_subnetwork.md b/docs/4.x/compute_subnetwork.md
index 64136a14..d2a17bd9 100644
--- a/docs/4.x/compute_subnetwork.md
+++ b/docs/4.x/compute_subnetwork.md
@@ -16,6 +16,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withExternalIpv6Prefix()`](#fn-withexternalipv6prefix)
 * [`fn withIpCidrRange()`](#fn-withipcidrrange)
 * [`fn withIpv6AccessType()`](#fn-withipv6accesstype)
 * [`fn withLogConfig()`](#fn-withlogconfig)
@@ -69,6 +70,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. This field can be set only at resource
 creation time. When `null`, the `description` field will be omitted from the resulting object.
+  - `external_ipv6_prefix` (`string`): The range of external IPv6 addresses that are owned by this subnetwork. When `null`, the `external_ipv6_prefix` field will be omitted from the resulting object.
   - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.
 Provide this property when you create the subnetwork. For example,
 10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and
@@ -89,10 +91,11 @@ Only networks that are in the distributed mode can have subnetworks.
 access Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'.
+  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', 'PRIVATE_SERVICE_CONNECT' or 'PRIVATE_NAT'([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).
 A subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
 A subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
 A subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.
+A subnetwork with purpose set to 'PRIVATE_NAT' is used as source range for Private NAT gateways.
 Note that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.
 If unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.
   - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.
@@ -144,6 +147,7 @@ injecting into a complete block.
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. This field can be set only at resource
 creation time. When `null`, the `description` field will be omitted from the resulting object.
+  - `external_ipv6_prefix` (`string`): The range of external IPv6 addresses that are owned by this subnetwork. When `null`, the `external_ipv6_prefix` field will be omitted from the resulting object.
   - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.
 Provide this property when you create the subnetwork. For example,
 10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and
@@ -164,10 +168,11 @@ Only networks that are in the distributed mode can have subnetworks.
 access Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'.
+  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', 'PRIVATE_SERVICE_CONNECT' or 'PRIVATE_NAT'([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).
 A subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
 A subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
 A subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.
+A subnetwork with purpose set to 'PRIVATE_NAT' is used as source range for Private NAT gateways.
 Note that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.
 If unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.
   - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.
@@ -214,6 +219,22 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withExternalIpv6Prefix
+
+```ts
+withExternalIpv6Prefix()
+```
+
+`google.string.withExternalIpv6Prefix` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the external_ipv6_prefix field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `external_ipv6_prefix` field.
+
+
 ### fn withIpCidrRange
 
 ```ts
diff --git a/docs/4.x/compute_target_https_proxy.md b/docs/4.x/compute_target_https_proxy.md
index 21b13c5f..e42b8c38 100644
--- a/docs/4.x/compute_target_https_proxy.md
+++ b/docs/4.x/compute_target_https_proxy.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCertificateManagerCertificates()`](#fn-withcertificatemanagercertificates)
 * [`fn withCertificateMap()`](#fn-withcertificatemap)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withHttpKeepAliveTimeoutSec()`](#fn-withhttpkeepalivetimeoutsec)
@@ -60,6 +61,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates fields can not be defined together.
+Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}' or just the self_link 'projects/{project}/locations/{location}/certificates/{resourceName}' When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.
   - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map
 associated with the given target proxy. This field can only be set for global target proxies.
 Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.
@@ -93,8 +98,9 @@ For details which ServerTlsPolicy resources are accepted with
 INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
 loadBalancingScheme consult ServerTlsPolicy documentation.
 If left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.
-  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate
-connections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
+  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
   - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with
 the TargetHttpsProxy resource. If not set, the TargetHttpsProxy
 resource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.
@@ -124,6 +130,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates fields can not be defined together.
+Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}' or just the self_link 'projects/{project}/locations/{location}/certificates/{resourceName}' When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.
   - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map
 associated with the given target proxy. This field can only be set for global target proxies.
 Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.
@@ -157,8 +167,9 @@ For details which ServerTlsPolicy resources are accepted with
 INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
 loadBalancingScheme consult ServerTlsPolicy documentation.
 If left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.
-  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate
-connections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
+  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
   - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with
 the TargetHttpsProxy resource. If not set, the TargetHttpsProxy
 resource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.
@@ -170,6 +181,22 @@ to the BackendService.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_target_https_proxy` resource into the root Terraform configuration.
 
 
+### fn withCertificateManagerCertificates
+
+```ts
+withCertificateManagerCertificates()
+```
+
+`google.list.withCertificateManagerCertificates` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the certificate_manager_certificates field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `certificate_manager_certificates` field.
+
+
 ### fn withCertificateMap
 
 ```ts
diff --git a/docs/4.x/compute_vpn_tunnel.md b/docs/4.x/compute_vpn_tunnel.md
index eb7a35f4..5d45ccce 100644
--- a/docs/4.x/compute_vpn_tunnel.md
+++ b/docs/4.x/compute_vpn_tunnel.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withIkeVersion()`](#fn-withikeversion)
+* [`fn withLabels()`](#fn-withlabels)
 * [`fn withLocalTrafficSelector()`](#fn-withlocaltrafficselector)
 * [`fn withName()`](#fn-withname)
 * [`fn withPeerExternalGateway()`](#fn-withpeerexternalgateway)
@@ -69,6 +70,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `ike_version` (`number`): IKE protocol version to use when establishing the VPN tunnel with
 peer VPN gateway.
 Acceptable IKE versions are 1 or 2. Default version is 2. When `null`, the `ike_version` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this VpnTunnel.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `local_traffic_selector` (`list`): Local traffic selector to use when establishing the VPN tunnel with
 peer VPN gateway. The value should be a CIDR formatted string,
 for example '192.168.0.0/16'. The ranges should be disjoint.
@@ -130,6 +135,10 @@ injecting into a complete block.
   - `ike_version` (`number`): IKE protocol version to use when establishing the VPN tunnel with
 peer VPN gateway.
 Acceptable IKE versions are 1 or 2. Default version is 2. When `null`, the `ike_version` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this VpnTunnel.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `local_traffic_selector` (`list`): Local traffic selector to use when establishing the VPN tunnel with
 peer VPN gateway. The value should be a CIDR formatted string,
 for example '192.168.0.0/16'. The ranges should be disjoint.
@@ -201,6 +210,22 @@ Terraform resource block to set or update the ike_version field.
   - `value` (`number`): The value to set for the `ike_version` field.
 
 
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
 ### fn withLocalTrafficSelector
 
 ```ts
@@ -480,6 +505,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/container_attached_cluster.md b/docs/4.x/container_attached_cluster.md
index e5aa0112..1b5dd1d2 100644
--- a/docs/4.x/container_attached_cluster.md
+++ b/docs/4.x/container_attached_cluster.md
@@ -35,6 +35,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withOidcConfigMixin()`](#fn-withoidcconfigmixin)
 * [`fn withPlatformVersion()`](#fn-withplatformversion)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withProxyConfig()`](#fn-withproxyconfig)
+* [`fn withProxyConfigMixin()`](#fn-withproxyconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj authorization`](#obj-authorization)
@@ -53,6 +55,10 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-monitoring_configmanaged_prometheus_confignew)
 * [`obj oidc_config`](#obj-oidc_config)
   * [`fn new()`](#fn-oidc_confignew)
+* [`obj proxy_config`](#obj-proxy_config)
+  * [`fn new()`](#fn-proxy_confignew)
+  * [`obj proxy_config.kubernetes_secret`](#obj-proxy_configkubernetes_secret)
+    * [`fn new()`](#fn-proxy_configkubernetes_secretnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -90,7 +96,11 @@ restrictions as Kubernetes annotations. The total size of all keys and
 values combined is limited to 256k. Key can have 2 segments: prefix (optional)
 and name (required), separated by a slash (/). Prefix must be a DNS subdomain.
 Name must be 63 characters or less, begin and end with alphanumerics,
-with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `description` (`string`): A human readable description of this attached cluster. Cannot be longer
 than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -116,6 +126,7 @@ Both clusters with public and private issuer URLs are supported.
 Clusters with public issuers only need to specify the 'issuer_url' field
 while clusters with private issuers need to provide both
 'issuer_url' and 'jwks'. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.
+  - `proxy_config` (`list[obj]`): Support for proxy configuration. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.proxy_config.new](#fn-proxy_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -145,7 +156,11 @@ restrictions as Kubernetes annotations. The total size of all keys and
 values combined is limited to 256k. Key can have 2 segments: prefix (optional)
 and name (required), separated by a slash (/). Prefix must be a DNS subdomain.
 Name must be 63 characters or less, begin and end with alphanumerics,
-with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `description` (`string`): A human readable description of this attached cluster. Cannot be longer
 than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -171,6 +186,7 @@ Both clusters with public and private issuer URLs are supported.
 Clusters with public issuers only need to specify the 'issuer_url' field
 while clusters with private issuers need to provide both
 'issuer_url' and 'jwks'. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.
+  - `proxy_config` (`list[obj]`): Support for proxy configuration. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.proxy_config.new](#fn-proxy_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -527,6 +543,43 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withProxyConfig
+
+```ts
+withProxyConfig()
+```
+
+`google.list[obj].withProxyConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withProxyConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy_config` field.
+
+
+### fn withProxyConfigMixin
+
+```ts
+withProxyConfigMixin()
+```
+
+`google.list[obj].withProxyConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withProxyConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -580,6 +633,12 @@ Terraform sub block.
 
 
 **Args**:
+  - `admin_groups` (`list`): Groups that can perform operations as a cluster admin. A managed
+ClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole
+to the groups. Up to ten admin groups can be provided.
+
+For more info on RBAC, see
+https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` field will be omitted from the resulting object.
   - `admin_users` (`list`): Users that can perform operations as a cluster admin. A managed
 ClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole
 to the users. Up to ten admin users can be provided.
@@ -753,6 +812,53 @@ Terraform sub block.
   - An attribute object that represents the `oidc_config` sub block.
 
 
+## obj proxy_config
+
+
+
+### fn proxy_config.new
+
+```ts
+new()
+```
+
+
+`google.container_attached_cluster.proxy_config.new` constructs a new object with attributes and blocks configured for the `proxy_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kubernetes_secret` (`list[obj]`): The Kubernetes Secret resource that contains the HTTP(S) proxy configuration. When `null`, the `kubernetes_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.proxy_config.kubernetes_secret.new](#fn-proxy_configkubernetes_secretnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `proxy_config` sub block.
+
+
+## obj proxy_config.kubernetes_secret
+
+
+
+### fn proxy_config.kubernetes_secret.new
+
+```ts
+new()
+```
+
+
+`google.container_attached_cluster.proxy_config.kubernetes_secret.new` constructs a new object with attributes and blocks configured for the `kubernetes_secret`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the kubernetes secret containing the proxy config.
+  - `namespace` (`string`): Namespace of the kubernetes secret containing the proxy config.
+
+**Returns**:
+  - An attribute object that represents the `kubernetes_secret` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/container_aws_cluster.md b/docs/4.x/container_aws_cluster.md
index 92bf34bb..683a648c 100644
--- a/docs/4.x/container_aws_cluster.md
+++ b/docs/4.x/container_aws_cluster.md
@@ -19,6 +19,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withAuthorization()`](#fn-withauthorization)
 * [`fn withAuthorizationMixin()`](#fn-withauthorizationmixin)
 * [`fn withAwsRegion()`](#fn-withawsregion)
+* [`fn withBinaryAuthorization()`](#fn-withbinaryauthorization)
+* [`fn withBinaryAuthorizationMixin()`](#fn-withbinaryauthorizationmixin)
 * [`fn withControlPlane()`](#fn-withcontrolplane)
 * [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
 * [`fn withDescription()`](#fn-withdescription)
@@ -33,8 +35,12 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj authorization`](#obj-authorization)
   * [`fn new()`](#fn-authorizationnew)
+  * [`obj authorization.admin_groups`](#obj-authorizationadmin_groups)
+    * [`fn new()`](#fn-authorizationadmin_groupsnew)
   * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
     * [`fn new()`](#fn-authorizationadmin_usersnew)
+* [`obj binary_authorization`](#obj-binary_authorization)
+  * [`fn new()`](#fn-binary_authorizationnew)
 * [`obj control_plane`](#obj-control_plane)
   * [`fn new()`](#fn-control_planenew)
   * [`obj control_plane.aws_services_authentication`](#obj-control_planeaws_services_authentication)
@@ -87,13 +93,17 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
   - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.
   - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.
   - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.
@@ -121,13 +131,17 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
   - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.
   - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.
   - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.
@@ -206,6 +220,43 @@ Terraform resource block to set or update the aws_region field.
   - `value` (`string`): The value to set for the `aws_region` field.
 
 
+### fn withBinaryAuthorization
+
+```ts
+withBinaryAuthorization()
+```
+
+`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
+### fn withBinaryAuthorizationMixin
+
+```ts
+withBinaryAuthorizationMixin()
+```
+
+`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
 ### fn withControlPlane
 
 ```ts
@@ -434,12 +485,36 @@ Terraform sub block.
 
 
 **Args**:
+  - `admin_groups` (`list[obj]`): Groups of users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the groups. Up to ten admin groups can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.admin_groups.new](#fn-authorizationadmin_groupsnew) constructor.
   - `admin_users` (`list[obj]`): Users to perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `authorization` sub block.
 
 
+## obj authorization.admin_groups
+
+
+
+### fn authorization.admin_groups.new
+
+```ts
+new()
+```
+
+
+`google.container_aws_cluster.authorization.admin_groups.new` constructs a new object with attributes and blocks configured for the `admin_groups`
+Terraform sub block.
+
+
+
+**Args**:
+  - `group` (`string`): The name of the group, e.g. `my-group@domain.com`.
+
+**Returns**:
+  - An attribute object that represents the `admin_groups` sub block.
+
+
 ## obj authorization.admin_users
 
 
@@ -463,6 +538,29 @@ Terraform sub block.
   - An attribute object that represents the `admin_users` sub block.
 
 
+## obj binary_authorization
+
+
+
+### fn binary_authorization.new
+
+```ts
+new()
+```
+
+
+`google.container_aws_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `evaluation_mode` (`string`): Mode of operation for Binary Authorization policy evaluation. Possible values: DISABLED, PROJECT_SINGLETON_POLICY_ENFORCE When `null`, the `evaluation_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `binary_authorization` sub block.
+
+
 ## obj control_plane
 
 
@@ -588,7 +686,7 @@ Terraform sub block.
   - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.
   - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.
   - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.
-  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. When `null`, the `throughput` field will be omitted from the resulting object.
+  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. If volume type is gp3 and throughput is not specified, the throughput will defaults to 125. When `null`, the `throughput` field will be omitted from the resulting object.
   - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.
 
 **Returns**:
@@ -639,7 +737,7 @@ Terraform sub block.
   - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.
   - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.
   - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.
-  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. When `null`, the `throughput` field will be omitted from the resulting object.
+  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. If volume type is gp3 and throughput is not specified, the throughput will defaults to 125. When `null`, the `throughput` field will be omitted from the resulting object.
   - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.
 
 **Returns**:
diff --git a/docs/4.x/container_aws_node_pool.md b/docs/4.x/container_aws_node_pool.md
index c97759e9..2af3d2f4 100644
--- a/docs/4.x/container_aws_node_pool.md
+++ b/docs/4.x/container_aws_node_pool.md
@@ -31,6 +31,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withSubnetId()`](#fn-withsubnetid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUpdateSettings()`](#fn-withupdatesettings)
+* [`fn withUpdateSettingsMixin()`](#fn-withupdatesettingsmixin)
 * [`fn withVersion()`](#fn-withversion)
 * [`obj autoscaling`](#obj-autoscaling)
   * [`fn new()`](#fn-autoscalingnew)
@@ -54,6 +56,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-max_pods_constraintnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
+* [`obj update_settings`](#obj-update_settings)
+  * [`fn new()`](#fn-update_settingsnew)
+  * [`obj update_settings.surge_settings`](#obj-update_settingssurge_settings)
+    * [`fn new()`](#fn-update_settingssurge_settingsnew)
 
 ## Fields
 
@@ -84,7 +90,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster` (`string`): The awsCluster for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
@@ -96,6 +105,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.
   - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+  - `update_settings` (`list[obj]`): Optional. Update settings control the speed and disruption of the node pool update. When `null`, the `update_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.update_settings.new](#fn-update_settingsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -119,7 +129,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster` (`string`): The awsCluster for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
@@ -131,6 +144,7 @@ injecting into a complete block.
   - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.
   - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+  - `update_settings` (`list[obj]`): Optional. Update settings control the speed and disruption of the node pool update. When `null`, the `update_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.update_settings.new](#fn-update_settingsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_node_pool` resource into the root Terraform configuration.
@@ -416,6 +430,43 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withUpdateSettings
+
+```ts
+withUpdateSettings()
+```
+
+`google.list[obj].withUpdateSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the update_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withUpdateSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `update_settings` field.
+
+
+### fn withUpdateSettingsMixin
+
+```ts
+withUpdateSettingsMixin()
+```
+
+`google.list[obj].withUpdateSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the update_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withUpdateSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `update_settings` field.
+
+
 ### fn withVersion
 
 ```ts
@@ -580,7 +631,7 @@ Terraform sub block.
   - `iops` (`number`): Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume. When `null`, the `iops` field will be omitted from the resulting object.
   - `kms_key_arn` (`string`): Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used. When `null`, the `kms_key_arn` field will be omitted from the resulting object.
   - `size_gib` (`number`): Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource. When `null`, the `size_gib` field will be omitted from the resulting object.
-  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. When `null`, the `throughput` field will be omitted from the resulting object.
+  - `throughput` (`number`): Optional. The throughput to provision for the volume, in MiB/s. Only valid if the volume type is GP3. If volume type is gp3 and throughput is not specified, the throughput will defaults to 125. When `null`, the `throughput` field will be omitted from the resulting object.
   - `volume_type` (`string`): Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3 When `null`, the `volume_type` field will be omitted from the resulting object.
 
 **Returns**:
@@ -704,3 +755,50 @@ Terraform sub block.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
+
+
+## obj update_settings
+
+
+
+### fn update_settings.new
+
+```ts
+new()
+```
+
+
+`google.container_aws_node_pool.update_settings.new` constructs a new object with attributes and blocks configured for the `update_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `surge_settings` (`list[obj]`): Optional. Settings for surge update. When `null`, the `surge_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.update_settings.surge_settings.new](#fn-update_settingssurge_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `update_settings` sub block.
+
+
+## obj update_settings.surge_settings
+
+
+
+### fn update_settings.surge_settings.new
+
+```ts
+new()
+```
+
+
+`google.container_aws_node_pool.update_settings.surge_settings.new` constructs a new object with attributes and blocks configured for the `surge_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_surge` (`number`): Optional. The maximum number of nodes that can be created beyond the current size of the node pool during the update process. When `null`, the `max_surge` field will be omitted from the resulting object.
+  - `max_unavailable` (`number`): Optional. The maximum number of nodes that can be simultaneously unavailable during the update process. A node is considered unavailable if its status is not Ready. When `null`, the `max_unavailable` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `surge_settings` sub block.
diff --git a/docs/4.x/container_azure_cluster.md b/docs/4.x/container_azure_cluster.md
index aca8914a..6cd3817a 100644
--- a/docs/4.x/container_azure_cluster.md
+++ b/docs/4.x/container_azure_cluster.md
@@ -37,6 +37,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj authorization`](#obj-authorization)
   * [`fn new()`](#fn-authorizationnew)
+  * [`obj authorization.admin_groups`](#obj-authorizationadmin_groups)
+    * [`fn new()`](#fn-authorizationadmin_groupsnew)
   * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
     * [`fn new()`](#fn-authorizationadmin_usersnew)
 * [`obj azure_services_authentication`](#obj-azure_services_authentication)
@@ -91,7 +93,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.
   - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -128,7 +133,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.
   - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -513,12 +521,36 @@ Terraform sub block.
 
 
 **Args**:
+  - `admin_groups` (`list[obj]`): Groups of users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole to the groups. Up to ten admin groups can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.admin_groups.new](#fn-authorizationadmin_groupsnew) constructor.
   - `admin_users` (`list[obj]`): Users that can perform operations as a cluster admin. A new ClusterRoleBinding will be created to grant the cluster-admin ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `authorization` sub block.
 
 
+## obj authorization.admin_groups
+
+
+
+### fn authorization.admin_groups.new
+
+```ts
+new()
+```
+
+
+`google.container_azure_cluster.authorization.admin_groups.new` constructs a new object with attributes and blocks configured for the `admin_groups`
+Terraform sub block.
+
+
+
+**Args**:
+  - `group` (`string`): The name of the group, e.g. `my-group@domain.com`.
+
+**Returns**:
+  - An attribute object that represents the `admin_groups` sub block.
+
+
 ## obj authorization.admin_users
 
 
diff --git a/docs/4.x/container_azure_node_pool.md b/docs/4.x/container_azure_node_pool.md
index 44c904e6..8f71a597 100644
--- a/docs/4.x/container_azure_node_pool.md
+++ b/docs/4.x/container_azure_node_pool.md
@@ -79,7 +79,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.
   - `cluster` (`string`): The azureCluster for the resource
   - `location` (`string`): The location for the resource
@@ -115,7 +118,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.
   - `cluster` (`string`): The azureCluster for the resource
   - `location` (`string`): The location for the resource
@@ -486,6 +492,7 @@ Terraform sub block.
 
 
 **Args**:
+  - `labels` (`obj`): Optional. The initial labels assigned to nodes of this node pool. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
   - `tags` (`obj`): Optional. A set of tags to apply to all underlying Azure resources for this node pool. This currently only includes Virtual Machine Scale Sets. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters. When `null`, the `tags` field will be omitted from the resulting object.
   - `vm_size` (`string`): Optional. The Azure VM size name. Example: `Standard_DS2_v2`. See (/anthos/clusters/docs/azure/reference/supported-vms) for options. When unspecified, it defaults to `Standard_DS2_v2`. When `null`, the `vm_size` field will be omitted from the resulting object.
   - `proxy_config` (`list[obj]`): Proxy configuration for outbound HTTP(S) traffic. When `null`, the `proxy_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.proxy_config.new](#fn-configproxy_confignew) constructor.
diff --git a/docs/4.x/container_cluster.md b/docs/4.x/container_cluster.md
index e504c90c..d0839292 100644
--- a/docs/4.x/container_cluster.md
+++ b/docs/4.x/container_cluster.md
@@ -35,11 +35,11 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDefaultMaxPodsPerNode()`](#fn-withdefaultmaxpodspernode)
 * [`fn withDefaultSnatStatus()`](#fn-withdefaultsnatstatus)
 * [`fn withDefaultSnatStatusMixin()`](#fn-withdefaultsnatstatusmixin)
+* [`fn withDeletionProtection()`](#fn-withdeletionprotection)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDnsConfig()`](#fn-withdnsconfig)
 * [`fn withDnsConfigMixin()`](#fn-withdnsconfigmixin)
 * [`fn withEnableAutopilot()`](#fn-withenableautopilot)
-* [`fn withEnableBinaryAuthorization()`](#fn-withenablebinaryauthorization)
 * [`fn withEnableIntranodeVisibility()`](#fn-withenableintranodevisibility)
 * [`fn withEnableK8SBetaApis()`](#fn-withenablek8sbetaapis)
 * [`fn withEnableK8SBetaApisMixin()`](#fn-withenablek8sbetaapismixin)
@@ -48,8 +48,12 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEnableLegacyAbac()`](#fn-withenablelegacyabac)
 * [`fn withEnableShieldedNodes()`](#fn-withenableshieldednodes)
 * [`fn withEnableTpu()`](#fn-withenabletpu)
+* [`fn withFleet()`](#fn-withfleet)
+* [`fn withFleetMixin()`](#fn-withfleetmixin)
 * [`fn withGatewayApiConfig()`](#fn-withgatewayapiconfig)
 * [`fn withGatewayApiConfigMixin()`](#fn-withgatewayapiconfigmixin)
+* [`fn withIdentityServiceConfig()`](#fn-withidentityserviceconfig)
+* [`fn withIdentityServiceConfigMixin()`](#fn-withidentityserviceconfigmixin)
 * [`fn withInitialNodeCount()`](#fn-withinitialnodecount)
 * [`fn withIpAllocationPolicy()`](#fn-withipallocationpolicy)
 * [`fn withIpAllocationPolicyMixin()`](#fn-withipallocationpolicymixin)
@@ -161,8 +165,12 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-dns_confignew)
 * [`obj enable_k8s_beta_apis`](#obj-enable_k8s_beta_apis)
   * [`fn new()`](#fn-enable_k8s_beta_apisnew)
+* [`obj fleet`](#obj-fleet)
+  * [`fn new()`](#fn-fleetnew)
 * [`obj gateway_api_config`](#obj-gateway_api_config)
   * [`fn new()`](#fn-gateway_api_confignew)
+* [`obj identity_service_config`](#obj-identity_service_config)
+  * [`fn new()`](#fn-identity_service_confignew)
 * [`obj ip_allocation_policy`](#obj-ip_allocation_policy)
   * [`fn new()`](#fn-ip_allocation_policynew)
   * [`obj ip_allocation_policy.additional_pod_ranges_config`](#obj-ip_allocation_policyadditional_pod_ranges_config)
@@ -229,6 +237,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-node_configsole_tenant_confignew)
     * [`obj node_config.sole_tenant_config.node_affinity`](#obj-node_configsole_tenant_confignode_affinity)
       * [`fn new()`](#fn-node_configsole_tenant_confignode_affinitynew)
+  * [`obj node_config.taint`](#obj-node_configtaint)
+    * [`fn new()`](#fn-node_configtaintnew)
   * [`obj node_config.workload_metadata_config`](#obj-node_configworkload_metadata_config)
     * [`fn new()`](#fn-node_configworkload_metadata_confignew)
 * [`obj node_pool`](#obj-node_pool)
@@ -239,6 +249,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-node_poolmanagementnew)
   * [`obj node_pool.network_config`](#obj-node_poolnetwork_config)
     * [`fn new()`](#fn-node_poolnetwork_confignew)
+    * [`obj node_pool.network_config.network_performance_config`](#obj-node_poolnetwork_confignetwork_performance_config)
+      * [`fn new()`](#fn-node_poolnetwork_confignetwork_performance_confignew)
     * [`obj node_pool.network_config.pod_cidr_overprovision_config`](#obj-node_poolnetwork_configpod_cidr_overprovision_config)
       * [`fn new()`](#fn-node_poolnetwork_configpod_cidr_overprovision_confignew)
   * [`obj node_pool.node_config`](#obj-node_poolnode_config)
@@ -271,6 +283,8 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-node_poolnode_configsole_tenant_confignew)
       * [`obj node_pool.node_config.sole_tenant_config.node_affinity`](#obj-node_poolnode_configsole_tenant_confignode_affinity)
         * [`fn new()`](#fn-node_poolnode_configsole_tenant_confignode_affinitynew)
+    * [`obj node_pool.node_config.taint`](#obj-node_poolnode_configtaint)
+      * [`fn new()`](#fn-node_poolnode_configtaintnew)
     * [`obj node_pool.node_config.workload_metadata_config`](#obj-node_poolnode_configworkload_metadata_config)
       * [`fn new()`](#fn-node_poolnode_configworkload_metadata_confignew)
   * [`obj node_pool.placement_policy`](#obj-node_poolplacement_policy)
@@ -349,9 +363,9 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.
   - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.
   - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
   - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.
-  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.
   - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.
   - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.
   - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.
@@ -365,7 +379,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and location.
   - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.
-  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.
+  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.
   - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.
   - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
@@ -383,7 +397,9 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.
   - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.
   - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.
+  - `fleet` (`list[obj]`): Fleet configuration of the cluster. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.fleet.new](#fn-fleetnew) constructor.
   - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.
+  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.
   - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.
   - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.
   - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
@@ -432,9 +448,9 @@ injecting into a complete block.
   - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.
   - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.
   - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
   - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.
-  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.
   - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.
   - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.
   - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.
@@ -448,7 +464,7 @@ injecting into a complete block.
   - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and location.
   - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.
-  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.
+  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.
   - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.
   - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
@@ -466,7 +482,9 @@ injecting into a complete block.
   - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.
   - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.
   - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.
+  - `fleet` (`list[obj]`): Fleet configuration of the cluster. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.fleet.new](#fn-fleetnew) constructor.
   - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.
+  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.
   - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.
   - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.
   - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
@@ -853,6 +871,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `default_snat_status` field.
 
 
+### fn withDeletionProtection
+
+```ts
+withDeletionProtection()
+```
+
+`google.bool.withDeletionProtection` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the deletion_protection field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `deletion_protection` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -922,22 +956,6 @@ Terraform resource block to set or update the enable_autopilot field.
   - `value` (`bool`): The value to set for the `enable_autopilot` field.
 
 
-### fn withEnableBinaryAuthorization
-
-```ts
-withEnableBinaryAuthorization()
-```
-
-`google.bool.withEnableBinaryAuthorization` constructs a mixin object that can be merged into the `bool`
-Terraform resource block to set or update the enable_binary_authorization field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`bool`): The value to set for the `enable_binary_authorization` field.
-
-
 ### fn withEnableIntranodeVisibility
 
 ```ts
@@ -1071,6 +1089,43 @@ Terraform resource block to set or update the enable_tpu field.
   - `value` (`bool`): The value to set for the `enable_tpu` field.
 
 
+### fn withFleet
+
+```ts
+withFleet()
+```
+
+`google.list[obj].withFleet` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withFleetMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet` field.
+
+
+### fn withFleetMixin
+
+```ts
+withFleetMixin()
+```
+
+`google.list[obj].withFleetMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withFleet](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet` field.
+
+
 ### fn withGatewayApiConfig
 
 ```ts
@@ -1108,6 +1163,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `gateway_api_config` field.
 
 
+### fn withIdentityServiceConfig
+
+```ts
+withIdentityServiceConfig()
+```
+
+`google.list[obj].withIdentityServiceConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the identity_service_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIdentityServiceConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.
+
+
+### fn withIdentityServiceConfigMixin
+
+```ts
+withIdentityServiceConfigMixin()
+```
+
+`google.list[obj].withIdentityServiceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the identity_service_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIdentityServiceConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.
+
+
 ### fn withInitialNodeCount
 
 ```ts
@@ -2451,6 +2543,7 @@ Terraform sub block.
 
 
 **Args**:
+  - `autoscaling_profile` (`string`): Configuration options for the Autoscaling profile feature, which lets you choose whether the cluster autoscaler should optimize for resource utilization or resource availability when deciding to remove nodes from a cluster. Can be BALANCED or OPTIMIZE_UTILIZATION. Defaults to BALANCED. When `null`, the `autoscaling_profile` field will be omitted from the resulting object.
   - `enabled` (`bool`): Whether node auto-provisioning is enabled. Resource limits for cpu and memory must be defined to enable node auto-provisioning. When `null`, the `enabled` field will be omitted from the resulting object.
   - `auto_provisioning_defaults` (`list[obj]`): Contains defaults for a node pool created by NAP. When `null`, the `auto_provisioning_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.auto_provisioning_defaults.new](#fn-cluster_autoscalingauto_provisioning_defaultsnew) constructor.
   - `resource_limits` (`list[obj]`): Global constraints for machine resources in the cluster. Configuring the cpu and memory types is required if node auto-provisioning is enabled. These limits will apply to node pool autoscaling in addition to node auto-provisioning. When `null`, the `resource_limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.resource_limits.new](#fn-cluster_autoscalingresource_limitsnew) constructor.
@@ -2784,6 +2877,29 @@ Terraform sub block.
   - An attribute object that represents the `enable_k8s_beta_apis` sub block.
 
 
+## obj fleet
+
+
+
+### fn fleet.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.fleet.new` constructs a new object with attributes and blocks configured for the `fleet`
+Terraform sub block.
+
+
+
+**Args**:
+  - `project` (`string`): The Fleet host project of the cluster. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `fleet` sub block.
+
+
 ## obj gateway_api_config
 
 
@@ -2807,6 +2923,29 @@ Terraform sub block.
   - An attribute object that represents the `gateway_api_config` sub block.
 
 
+## obj identity_service_config
+
+
+
+### fn identity_service_config.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.identity_service_config.new` constructs a new object with attributes and blocks configured for the `identity_service_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to enable the Identity Service component. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `identity_service_config` sub block.
+
+
 ## obj ip_allocation_policy
 
 
@@ -3234,7 +3373,7 @@ Terraform sub block.
 
 **Args**:
   - `enabled` (`bool`): Whether network policy is enabled on the cluster.
-  - `provider` (`string`): The selected network policy provider. Defaults to PROVIDER_UNSPECIFIED. When `null`, the `provider` field will be omitted from the resulting object.
+  - `provider` (`string`): The selected network policy provider. When `null`, the `provider` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `network_policy` sub block.
@@ -3275,7 +3414,6 @@ Terraform sub block.
   - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.
   - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.
   - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.
-  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.
   - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.
   - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.
@@ -3289,6 +3427,7 @@ Terraform sub block.
   - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.
   - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.
   - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.
+  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.taint.new](#fn-node_configtaintnew) constructor.
   - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.
 
 **Returns**:
@@ -3499,7 +3638,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.
+  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.
+  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `linux_node_config` sub block.
@@ -3625,6 +3765,31 @@ Terraform sub block.
   - An attribute object that represents the `node_affinity` sub block.
 
 
+## obj node_config.taint
+
+
+
+### fn node_config.taint.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Effect for taint.
+  - `key` (`string`): Key for taint.
+  - `value` (`string`): Value for taint.
+
+**Returns**:
+  - An attribute object that represents the `taint` sub block.
+
+
 ## obj node_config.workload_metadata_config
 
 
@@ -3727,8 +3892,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.
-  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
+  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.
+  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `management` sub block.
@@ -3755,12 +3920,36 @@ Terraform sub block.
   - `enable_private_nodes` (`bool`): Whether nodes have internal IP addresses only. When `null`, the `enable_private_nodes` field will be omitted from the resulting object.
   - `pod_ipv4_cidr_block` (`string`): The IP address range for pod IPs in this node pool. Only applicable if create_pod_range is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) to pick a specific range to use. When `null`, the `pod_ipv4_cidr_block` field will be omitted from the resulting object.
   - `pod_range` (`string`): The ID of the secondary range for pod IPs. If create_pod_range is true, this ID is used for the new range. If create_pod_range is false, uses an existing secondary range with this ID. When `null`, the `pod_range` field will be omitted from the resulting object.
+  - `network_performance_config` (`list[obj]`): Network bandwidth tier configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.network_config.network_performance_config.new](#fn-node_poolnode_poolnetwork_performance_confignew) constructor.
   - `pod_cidr_overprovision_config` (`list[obj]`): Configuration for node-pool level pod cidr overprovision. If not set, the cluster level setting will be inherited When `null`, the `pod_cidr_overprovision_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.network_config.pod_cidr_overprovision_config.new](#fn-node_poolnode_poolpod_cidr_overprovision_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `network_config` sub block.
 
 
+## obj node_pool.network_config.network_performance_config
+
+
+
+### fn node_pool.network_config.network_performance_config.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.node_pool.network_config.network_performance_config.new` constructs a new object with attributes and blocks configured for the `network_performance_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `total_egress_bandwidth_tier` (`string`): Specifies the total network bandwidth tier for the NodePool.
+
+**Returns**:
+  - An attribute object that represents the `network_performance_config` sub block.
+
+
 ## obj node_pool.network_config.pod_cidr_overprovision_config
 
 
@@ -3819,7 +4008,6 @@ Terraform sub block.
   - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.
   - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.
   - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.
-  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.advanced_machine_features.new](#fn-node_poolnode_pooladvanced_machine_featuresnew) constructor.
   - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.confidential_nodes.new](#fn-node_poolnode_poolconfidential_nodesnew) constructor.
   - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_poolnode_poolephemeral_storage_local_ssd_confignew) constructor.
@@ -3833,6 +4021,7 @@ Terraform sub block.
   - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.reservation_affinity.new](#fn-node_poolnode_poolreservation_affinitynew) constructor.
   - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.shielded_instance_config.new](#fn-node_poolnode_poolshielded_instance_confignew) constructor.
   - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.sole_tenant_config.new](#fn-node_poolnode_poolsole_tenant_confignew) constructor.
+  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.taint.new](#fn-node_poolnode_pooltaintnew) constructor.
   - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.workload_metadata_config.new](#fn-node_poolnode_poolworkload_metadata_confignew) constructor.
 
 **Returns**:
@@ -4043,7 +4232,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.
+  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.
+  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `linux_node_config` sub block.
@@ -4169,6 +4359,31 @@ Terraform sub block.
   - An attribute object that represents the `node_affinity` sub block.
 
 
+## obj node_pool.node_config.taint
+
+
+
+### fn node_pool.node_config.taint.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Effect for taint.
+  - `key` (`string`): Key for taint.
+  - `value` (`string`): Value for taint.
+
+**Returns**:
+  - An attribute object that represents the `taint` sub block.
+
+
 ## obj node_pool.node_config.workload_metadata_config
 
 
@@ -4598,7 +4813,7 @@ Terraform sub block.
 
 **Args**:
   - `mode` (`string`): Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC. When `null`, the `mode` field will be omitted from the resulting object.
-  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED and VULNERABILITY_BASIC. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.
+  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED, VULNERABILITY_BASIC and VULNERABILITY_ENTERPRISE. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `security_posture_config` sub block.
diff --git a/docs/4.x/container_node_pool.md b/docs/4.x/container_node_pool.md
index c88332fb..02fa8034 100644
--- a/docs/4.x/container_node_pool.md
+++ b/docs/4.x/container_node_pool.md
@@ -45,6 +45,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-managementnew)
 * [`obj network_config`](#obj-network_config)
   * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.network_performance_config`](#obj-network_confignetwork_performance_config)
+    * [`fn new()`](#fn-network_confignetwork_performance_confignew)
   * [`obj network_config.pod_cidr_overprovision_config`](#obj-network_configpod_cidr_overprovision_config)
     * [`fn new()`](#fn-network_configpod_cidr_overprovision_confignew)
 * [`obj node_config`](#obj-node_config)
@@ -77,6 +79,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-node_configsole_tenant_confignew)
     * [`obj node_config.sole_tenant_config.node_affinity`](#obj-node_configsole_tenant_confignode_affinity)
       * [`fn new()`](#fn-node_configsole_tenant_confignode_affinitynew)
+  * [`obj node_config.taint`](#obj-node_configtaint)
+    * [`fn new()`](#fn-node_configtaintnew)
   * [`obj node_config.workload_metadata_config`](#obj-node_configworkload_metadata_config)
     * [`fn new()`](#fn-node_configworkload_metadata_confignew)
 * [`obj placement_policy`](#obj-placement_policy)
@@ -643,8 +647,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.
-  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
+  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.
+  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `management` sub block.
@@ -671,12 +675,36 @@ Terraform sub block.
   - `enable_private_nodes` (`bool`): Whether nodes have internal IP addresses only. When `null`, the `enable_private_nodes` field will be omitted from the resulting object.
   - `pod_ipv4_cidr_block` (`string`): The IP address range for pod IPs in this node pool. Only applicable if create_pod_range is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) to pick a specific range to use. When `null`, the `pod_ipv4_cidr_block` field will be omitted from the resulting object.
   - `pod_range` (`string`): The ID of the secondary range for pod IPs. If create_pod_range is true, this ID is used for the new range. If create_pod_range is false, uses an existing secondary range with this ID. When `null`, the `pod_range` field will be omitted from the resulting object.
+  - `network_performance_config` (`list[obj]`): Network bandwidth tier configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.network_config.network_performance_config.new](#fn-network_confignetwork_performance_confignew) constructor.
   - `pod_cidr_overprovision_config` (`list[obj]`): Configuration for node-pool level pod cidr overprovision. If not set, the cluster level setting will be inherited When `null`, the `pod_cidr_overprovision_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.network_config.pod_cidr_overprovision_config.new](#fn-network_configpod_cidr_overprovision_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `network_config` sub block.
 
 
+## obj network_config.network_performance_config
+
+
+
+### fn network_config.network_performance_config.new
+
+```ts
+new()
+```
+
+
+`google.container_node_pool.network_config.network_performance_config.new` constructs a new object with attributes and blocks configured for the `network_performance_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `total_egress_bandwidth_tier` (`string`): Specifies the total network bandwidth tier for the NodePool.
+
+**Returns**:
+  - An attribute object that represents the `network_performance_config` sub block.
+
+
 ## obj network_config.pod_cidr_overprovision_config
 
 
@@ -735,7 +763,6 @@ Terraform sub block.
   - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.
   - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.
   - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.
-  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.
   - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.
   - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.
@@ -749,6 +776,7 @@ Terraform sub block.
   - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.
   - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.
   - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.
+  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.taint.new](#fn-node_configtaintnew) constructor.
   - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.
 
 **Returns**:
@@ -959,7 +987,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.
+  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.
+  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `linux_node_config` sub block.
@@ -1085,6 +1114,31 @@ Terraform sub block.
   - An attribute object that represents the `node_affinity` sub block.
 
 
+## obj node_config.taint
+
+
+
+### fn node_config.taint.new
+
+```ts
+new()
+```
+
+
+`google.container_node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Effect for taint.
+  - `key` (`string`): Key for taint.
+  - `value` (`string`): Value for taint.
+
+**Returns**:
+  - An attribute object that represents the `taint` sub block.
+
+
 ## obj node_config.workload_metadata_config
 
 
diff --git a/docs/4.x/data/bigquery_dataset.md b/docs/4.x/data/bigquery_dataset.md
new file mode 100644
index 00000000..8fb20b86
--- /dev/null
+++ b/docs/4.x/data/bigquery_dataset.md
@@ -0,0 +1,115 @@
+---
+permalink: /data/bigquery_dataset/
+---
+
+# data.bigquery_dataset
+
+`bigquery_dataset` represents the `google_bigquery_dataset` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDatasetId()`](#fn-withdatasetid)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.bigquery_dataset.new` injects a new `data_google_bigquery_dataset` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.bigquery_dataset.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.bigquery_dataset` using the reference:
+
+    $._ref.data_google_bigquery_dataset.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_bigquery_dataset.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID
+must contain only letters (a-z, A-Z), numbers (0-9), or
+underscores (_). The maximum length is 1,024 characters.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`
+Terraform data source.
+
+Unlike [google.data.bigquery_dataset.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID
+must contain only letters (a-z, A-Z), numbers (0-9), or
+underscores (_). The maximum length is 1,024 characters.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `bigquery_dataset` data source into the root Terraform configuration.
+
+
+### fn withDatasetId
+
+```ts
+withDatasetId()
+```
+
+`google.string.withDatasetId` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the dataset_id field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `dataset_id` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/cloud_identity_group_lookup.md b/docs/4.x/data/cloud_identity_group_lookup.md
new file mode 100644
index 00000000..79d36873
--- /dev/null
+++ b/docs/4.x/data/cloud_identity_group_lookup.md
@@ -0,0 +1,144 @@
+---
+permalink: /data/cloud_identity_group_lookup/
+---
+
+# data.cloud_identity_group_lookup
+
+`cloud_identity_group_lookup` represents the `google_cloud_identity_group_lookup` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withGroupKey()`](#fn-withgroupkey)
+* [`fn withGroupKeyMixin()`](#fn-withgroupkeymixin)
+* [`obj group_key`](#obj-group_key)
+  * [`fn new()`](#fn-group_keynew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.cloud_identity_group_lookup.new` injects a new `data_google_cloud_identity_group_lookup` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.cloud_identity_group_lookup.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.cloud_identity_group_lookup` using the reference:
+
+    $._ref.data_google_cloud_identity_group_lookup.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_cloud_identity_group_lookup.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.
+An entity can represent either a group with an optional namespace or a user without a namespace.
+The combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.cloud_identity_group_lookup.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_identity_group_lookup`
+Terraform data source.
+
+Unlike [google.data.cloud_identity_group_lookup.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.
+An entity can represent either a group with an optional namespace or a user without a namespace.
+The combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_identity_group_lookup` data source into the root Terraform configuration.
+
+
+### fn withGroupKey
+
+```ts
+withGroupKey()
+```
+
+`google.list[obj].withGroupKey` constructs a mixin object that can be merged into the `list[obj]`
+Terraform data source block to set or update the group_key field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withGroupKeyMixin](TODO) function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `group_key` field.
+
+
+### fn withGroupKeyMixin
+
+```ts
+withGroupKeyMixin()
+```
+
+`google.list[obj].withGroupKeyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform data source block to set or update the group_key field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withGroupKey](TODO)
+function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `group_key` field.
+
+
+## obj group_key
+
+
+
+### fn group_key.new
+
+```ts
+new()
+```
+
+
+`google.cloud_identity_group_lookup.group_key.new` constructs a new object with attributes and blocks configured for the `group_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `namespace` (`string`): The namespace in which the entity exists. If not specified, the EntityKey represents a Google-managed entity such as a Google user or a Google Group.
+If specified, the EntityKey represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of identitysources/{identity_source}. When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `group_key` sub block.
diff --git a/docs/4.x/data/cloud_run_v2_job.md b/docs/4.x/data/cloud_run_v2_job.md
new file mode 100644
index 00000000..7a20a837
--- /dev/null
+++ b/docs/4.x/data/cloud_run_v2_job.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/cloud_run_v2_job/
+---
+
+# data.cloud_run_v2_job
+
+`cloud_run_v2_job` represents the `google_cloud_run_v2_job` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.cloud_run_v2_job.new` injects a new `data_google_cloud_run_v2_job` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.cloud_run_v2_job.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.cloud_run_v2_job` using the reference:
+
+    $._ref.data_google_cloud_run_v2_job.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_cloud_run_v2_job.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Job.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`
+Terraform data source.
+
+Unlike [google.data.cloud_run_v2_job.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Job.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_job` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/cloud_run_v2_service.md b/docs/4.x/data/cloud_run_v2_service.md
new file mode 100644
index 00000000..f5ef0e2c
--- /dev/null
+++ b/docs/4.x/data/cloud_run_v2_service.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/cloud_run_v2_service/
+---
+
+# data.cloud_run_v2_service
+
+`cloud_run_v2_service` represents the `google_cloud_run_v2_service` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.cloud_run_v2_service.new` injects a new `data_google_cloud_run_v2_service` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.cloud_run_v2_service.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.cloud_run_v2_service` using the reference:
+
+    $._ref.data_google_cloud_run_v2_service.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_cloud_run_v2_service.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Service.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`
+Terraform data source.
+
+Unlike [google.data.cloud_run_v2_service.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Service.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_service` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/compute_machine_types.md b/docs/4.x/data/compute_machine_types.md
new file mode 100644
index 00000000..9abd965c
--- /dev/null
+++ b/docs/4.x/data/compute_machine_types.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/compute_machine_types/
+---
+
+# data.compute_machine_types
+
+`compute_machine_types` represents the `google_compute_machine_types` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withFilter()`](#fn-withfilter)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withZone()`](#fn-withzone)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.compute_machine_types.new` injects a new `data_google_compute_machine_types` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.compute_machine_types.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.compute_machine_types` using the reference:
+
+    $._ref.data_google_compute_machine_types.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_compute_machine_types.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `filter` (`string`): Set the `filter` field on the resulting data source block. When `null`, the `filter` field will be omitted from the resulting object.
+  - `project` (`string`): Project ID for this request. When `null`, the `project` field will be omitted from the resulting object.
+  - `zone` (`string`): The name of the zone for this request. When `null`, the `zone` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.compute_machine_types.newAttrs` constructs a new object with attributes and blocks configured for the `compute_machine_types`
+Terraform data source.
+
+Unlike [google.data.compute_machine_types.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `filter` (`string`): Set the `filter` field on the resulting object. When `null`, the `filter` field will be omitted from the resulting object.
+  - `project` (`string`): Project ID for this request. When `null`, the `project` field will be omitted from the resulting object.
+  - `zone` (`string`): The name of the zone for this request. When `null`, the `zone` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_machine_types` data source into the root Terraform configuration.
+
+
+### fn withFilter
+
+```ts
+withFilter()
+```
+
+`google.string.withFilter` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the filter field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `filter` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withZone
+
+```ts
+withZone()
+```
+
+`google.string.withZone` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the zone field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `zone` field.
diff --git a/docs/4.x/data/compute_networks.md b/docs/4.x/data/compute_networks.md
new file mode 100644
index 00000000..0ff5be0f
--- /dev/null
+++ b/docs/4.x/data/compute_networks.md
@@ -0,0 +1,92 @@
+---
+permalink: /data/compute_networks/
+---
+
+# data.compute_networks
+
+`compute_networks` represents the `google_compute_networks` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.compute_networks.new` injects a new `data_google_compute_networks` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.compute_networks.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.compute_networks` using the reference:
+
+    $._ref.data_google_compute_networks.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_compute_networks.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.compute_networks.newAttrs` constructs a new object with attributes and blocks configured for the `compute_networks`
+Terraform data source.
+
+Unlike [google.data.compute_networks.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_networks` data source into the root Terraform configuration.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/compute_region_disk.md b/docs/4.x/data/compute_region_disk.md
new file mode 100644
index 00000000..bbef87d5
--- /dev/null
+++ b/docs/4.x/data/compute_region_disk.md
@@ -0,0 +1,142 @@
+---
+permalink: /data/compute_region_disk/
+---
+
+# data.compute_region_disk
+
+`compute_region_disk` represents the `google_compute_region_disk` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRegion()`](#fn-withregion)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.compute_region_disk.new` injects a new `data_google_compute_region_disk` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.compute_region_disk.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.compute_region_disk` using the reference:
+
+    $._ref.data_google_compute_region_disk.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_compute_region_disk.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): Name of the resource. Provided by the client when the resource is
+created. The name must be 1-63 characters long, and comply with
+RFC1035. Specifically, the name must be 1-63 characters long and match
+the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the
+first character must be a lowercase letter, and all following
+characters must be a dash, lowercase letter, or digit, except the last
+character, which cannot be a dash.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.compute_region_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_disk`
+Terraform data source.
+
+Unlike [google.data.compute_region_disk.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): Name of the resource. Provided by the client when the resource is
+created. The name must be 1-63 characters long, and comply with
+RFC1035. Specifically, the name must be 1-63 characters long and match
+the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the
+first character must be a lowercase letter, and all following
+characters must be a dash, lowercase letter, or digit, except the last
+character, which cannot be a dash.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_region_disk` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the region field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
diff --git a/docs/4.x/data/compute_region_network_endpoint_group.md b/docs/4.x/data/compute_region_network_endpoint_group.md
index d297a68d..0ae6625a 100644
--- a/docs/4.x/data/compute_region_network_endpoint_group.md
+++ b/docs/4.x/data/compute_region_network_endpoint_group.md
@@ -57,7 +57,7 @@ first character must be a lowercase letter, and all following
 characters must be a dash, lowercase letter, or digit, except the last
 character, which cannot be a dash. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): A reference to the region where the Serverless NEGs Reside. When `null`, the `region` field will be omitted from the resulting object.
+  - `region` (`string`): A reference to the region where the regional NEGs reside. When `null`, the `region` field will be omitted from the resulting object.
   - `self_link` (`string`): Set the `self_link` field on the resulting data source block. When `null`, the `self_link` field will be omitted from the resulting object.
 
 **Returns**:
@@ -90,7 +90,7 @@ first character must be a lowercase letter, and all following
 characters must be a dash, lowercase letter, or digit, except the last
 character, which cannot be a dash. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): A reference to the region where the Serverless NEGs Reside. When `null`, the `region` field will be omitted from the resulting object.
+  - `region` (`string`): A reference to the region where the regional NEGs reside. When `null`, the `region` field will be omitted from the resulting object.
   - `self_link` (`string`): Set the `self_link` field on the resulting object. When `null`, the `self_link` field will be omitted from the resulting object.
 
 **Returns**:
diff --git a/docs/4.x/data/compute_reservation.md b/docs/4.x/data/compute_reservation.md
new file mode 100644
index 00000000..68146ee2
--- /dev/null
+++ b/docs/4.x/data/compute_reservation.md
@@ -0,0 +1,142 @@
+---
+permalink: /data/compute_reservation/
+---
+
+# data.compute_reservation
+
+`compute_reservation` represents the `google_compute_reservation` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withZone()`](#fn-withzone)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.compute_reservation.new` injects a new `data_google_compute_reservation` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.compute_reservation.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.compute_reservation` using the reference:
+
+    $._ref.data_google_compute_reservation.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_compute_reservation.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): Name of the resource. Provided by the client when the resource is
+created. The name must be 1-63 characters long, and comply with
+RFC1035. Specifically, the name must be 1-63 characters long and match
+the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the
+first character must be a lowercase letter, and all following
+characters must be a dash, lowercase letter, or digit, except the last
+character, which cannot be a dash.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+  - `zone` (`string`): The zone where the reservation is made.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.compute_reservation.newAttrs` constructs a new object with attributes and blocks configured for the `compute_reservation`
+Terraform data source.
+
+Unlike [google.data.compute_reservation.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): Name of the resource. Provided by the client when the resource is
+created. The name must be 1-63 characters long, and comply with
+RFC1035. Specifically, the name must be 1-63 characters long and match
+the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the
+first character must be a lowercase letter, and all following
+characters must be a dash, lowercase letter, or digit, except the last
+character, which cannot be a dash.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `zone` (`string`): The zone where the reservation is made.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_reservation` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withZone
+
+```ts
+withZone()
+```
+
+`google.string.withZone` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the zone field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `zone` field.
diff --git a/docs/4.x/data/dns_managed_zones.md b/docs/4.x/data/dns_managed_zones.md
new file mode 100644
index 00000000..9671f596
--- /dev/null
+++ b/docs/4.x/data/dns_managed_zones.md
@@ -0,0 +1,155 @@
+---
+permalink: /data/dns_managed_zones/
+---
+
+# data.dns_managed_zones
+
+`dns_managed_zones` represents the `google_dns_managed_zones` Terraform data source.
+
+Provides access to all zones for a given project within Google Cloud DNS
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withManagedZones()`](#fn-withmanagedzones)
+* [`fn withManagedZonesMixin()`](#fn-withmanagedzonesmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`obj managed_zones`](#obj-managed_zones)
+  * [`fn new()`](#fn-managed_zonesnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.dns_managed_zones.new` injects a new `data_google_dns_managed_zones` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.dns_managed_zones.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.dns_managed_zones` using the reference:
+
+    $._ref.data_google_dns_managed_zones.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_dns_managed_zones.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `project` (`string`): The ID of the project for the Google Cloud. When `null`, the `project` field will be omitted from the resulting object.
+  - `managed_zones` (`list[obj]`): The list of managed zones in the given project. When `null`, the `managed_zones` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.dns_managed_zones.managed_zones.new](#fn-managed_zonesnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.dns_managed_zones.newAttrs` constructs a new object with attributes and blocks configured for the `dns_managed_zones`
+Terraform data source.
+
+Unlike [google.data.dns_managed_zones.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `project` (`string`): The ID of the project for the Google Cloud. When `null`, the `project` field will be omitted from the resulting object.
+  - `managed_zones` (`list[obj]`): The list of managed zones in the given project. When `null`, the `managed_zones` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.dns_managed_zones.managed_zones.new](#fn-managed_zonesnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `dns_managed_zones` data source into the root Terraform configuration.
+
+
+### fn withManagedZones
+
+```ts
+withManagedZones()
+```
+
+`google.list[obj].withManagedZones` constructs a mixin object that can be merged into the `list[obj]`
+Terraform data source block to set or update the managed_zones field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withManagedZonesMixin](TODO) function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `managed_zones` field.
+
+
+### fn withManagedZonesMixin
+
+```ts
+withManagedZonesMixin()
+```
+
+`google.list[obj].withManagedZonesMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform data source block to set or update the managed_zones field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withManagedZones](TODO)
+function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `managed_zones` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+## obj managed_zones
+
+
+
+### fn managed_zones.new
+
+```ts
+new()
+```
+
+
+`google.dns_managed_zones.managed_zones.new` constructs a new object with attributes and blocks configured for the `managed_zones`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `managed_zones` sub block.
diff --git a/docs/4.x/data/filestore_instance.md b/docs/4.x/data/filestore_instance.md
new file mode 100644
index 00000000..8449aa52
--- /dev/null
+++ b/docs/4.x/data/filestore_instance.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/filestore_instance/
+---
+
+# data.filestore_instance
+
+`filestore_instance` represents the `google_filestore_instance` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.filestore_instance.new` injects a new `data_google_filestore_instance` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.filestore_instance.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.filestore_instance` using the reference:
+
+    $._ref.data_google_filestore_instance.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_filestore_instance.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the instance.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.filestore_instance.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_instance`
+Terraform data source.
+
+Unlike [google.data.filestore_instance.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the instance.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `filestore_instance` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/game_services_game_server_deployment_rollout.md b/docs/4.x/data/game_services_game_server_deployment_rollout.md
deleted file mode 100644
index 765128e7..00000000
--- a/docs/4.x/data/game_services_game_server_deployment_rollout.md
+++ /dev/null
@@ -1,92 +0,0 @@
----
-permalink: /data/game_services_game_server_deployment_rollout/
----
-
-# data.game_services_game_server_deployment_rollout
-
-`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform data source.
-
-
-
-This package contains functions and utilities for setting up the data source using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.data.game_services_game_server_deployment_rollout.new` injects a new `data_google_game_services_game_server_deployment_rollout` Terraform `data source`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.data.game_services_game_server_deployment_rollout.new('some_id')
-
-You can get the reference to the `id` field of the created `google.data.game_services_game_server_deployment_rollout` using the reference:
-
-    $._ref.data_google_game_services_game_server_deployment_rollout.some_id.get('id')
-
-This is the same as directly entering `"${ data_google_game_services_game_server_deployment_rollout.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `dataSrcLabel` (`string`): The name label of the block.
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-
-**Returns**:
-- A mixin object that injects the new data source into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.data.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`
-Terraform data source.
-
-Unlike [google.data.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `data source`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `game_services_game_server_deployment_rollout` data source into the root Terraform configuration.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the deployment_id field.
-
-
-
-**Args**:
-  - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
diff --git a/docs/4.x/data/gke_hub_membership_iam_policy.md b/docs/4.x/data/gke_hub_membership_iam_policy.md
index 9a0c2d08..58ab9ae8 100644
--- a/docs/4.x/data/gke_hub_membership_iam_policy.md
+++ b/docs/4.x/data/gke_hub_membership_iam_policy.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the data source usi
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
 
@@ -47,6 +48,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting data source block.
   - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
 
@@ -72,6 +74,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
 
@@ -79,6 +82,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `gke_hub_membership_iam_policy` data source into the root Terraform configuration.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembershipId
 
 ```ts
diff --git a/docs/4.x/data/index.md b/docs/4.x/data/index.md
index 27402ae4..89dbf569 100644
--- a/docs/4.x/data/index.md
+++ b/docs/4.x/data/index.md
@@ -24,6 +24,7 @@ permalink: /data/
 * [bigquery_analytics_hub_listing_iam_policy](bigquery_analytics_hub_listing_iam_policy.md)
 * [bigquery_connection_iam_policy](bigquery_connection_iam_policy.md)
 * [bigquery_datapolicy_data_policy_iam_policy](bigquery_datapolicy_data_policy_iam_policy.md)
+* [bigquery_dataset](bigquery_dataset.md)
 * [bigquery_dataset_iam_policy](bigquery_dataset_iam_policy.md)
 * [bigquery_default_service_account](bigquery_default_service_account.md)
 * [bigquery_table_iam_policy](bigquery_table_iam_policy.md)
@@ -35,12 +36,15 @@ permalink: /data/
 * [certificate_manager_certificate_map](certificate_manager_certificate_map.md)
 * [client_config](client_config.md)
 * [client_openid_userinfo](client_openid_userinfo.md)
+* [cloud_identity_group_lookup](cloud_identity_group_lookup.md)
 * [cloud_identity_group_memberships](cloud_identity_group_memberships.md)
 * [cloud_identity_groups](cloud_identity_groups.md)
 * [cloud_run_locations](cloud_run_locations.md)
 * [cloud_run_service](cloud_run_service.md)
 * [cloud_run_service_iam_policy](cloud_run_service_iam_policy.md)
+* [cloud_run_v2_job](cloud_run_v2_job.md)
 * [cloud_run_v2_job_iam_policy](cloud_run_v2_job_iam_policy.md)
+* [cloud_run_v2_service](cloud_run_v2_service.md)
 * [cloud_run_v2_service_iam_policy](cloud_run_v2_service_iam_policy.md)
 * [cloud_tasks_queue_iam_policy](cloud_tasks_queue_iam_policy.md)
 * [cloudbuild_trigger](cloudbuild_trigger.md)
@@ -49,7 +53,6 @@ permalink: /data/
 * [cloudfunctions2_function_iam_policy](cloudfunctions2_function_iam_policy.md)
 * [cloudfunctions_function](cloudfunctions_function.md)
 * [cloudfunctions_function_iam_policy](cloudfunctions_function_iam_policy.md)
-* [cloudiot_registry_iam_policy](cloudiot_registry_iam_policy.md)
 * [composer_environment](composer_environment.md)
 * [composer_image_versions](composer_image_versions.md)
 * [compute_address](compute_address.md)
@@ -73,16 +76,20 @@ permalink: /data/
 * [compute_instance_serial_port](compute_instance_serial_port.md)
 * [compute_instance_template](compute_instance_template.md)
 * [compute_lb_ip_ranges](compute_lb_ip_ranges.md)
+* [compute_machine_types](compute_machine_types.md)
 * [compute_network](compute_network.md)
 * [compute_network_endpoint_group](compute_network_endpoint_group.md)
 * [compute_network_peering](compute_network_peering.md)
+* [compute_networks](compute_networks.md)
 * [compute_node_types](compute_node_types.md)
+* [compute_region_disk](compute_region_disk.md)
 * [compute_region_disk_iam_policy](compute_region_disk_iam_policy.md)
 * [compute_region_instance_group](compute_region_instance_group.md)
 * [compute_region_instance_template](compute_region_instance_template.md)
 * [compute_region_network_endpoint_group](compute_region_network_endpoint_group.md)
 * [compute_region_ssl_certificate](compute_region_ssl_certificate.md)
 * [compute_regions](compute_regions.md)
+* [compute_reservation](compute_reservation.md)
 * [compute_resource_policy](compute_resource_policy.md)
 * [compute_router](compute_router.md)
 * [compute_router_nat](compute_router_nat.md)
@@ -123,14 +130,15 @@ permalink: /data/
 * [dns_keys](dns_keys.md)
 * [dns_managed_zone](dns_managed_zone.md)
 * [dns_managed_zone_iam_policy](dns_managed_zone_iam_policy.md)
+* [dns_managed_zones](dns_managed_zones.md)
 * [dns_record_set](dns_record_set.md)
 * [endpoints_service_consumers_iam_policy](endpoints_service_consumers_iam_policy.md)
 * [endpoints_service_iam_policy](endpoints_service_iam_policy.md)
+* [filestore_instance](filestore_instance.md)
 * [folder](folder.md)
 * [folder_iam_policy](folder_iam_policy.md)
 * [folder_organization_policy](folder_organization_policy.md)
 * [folders](folders.md)
-* [game_services_game_server_deployment_rollout](game_services_game_server_deployment_rollout.md)
 * [gke_backup_backup_plan_iam_policy](gke_backup_backup_plan_iam_policy.md)
 * [gke_backup_restore_plan_iam_policy](gke_backup_restore_plan_iam_policy.md)
 * [gke_hub_feature_iam_policy](gke_hub_feature_iam_policy.md)
@@ -161,7 +169,10 @@ permalink: /data/
 * [kms_key_ring_iam_policy](kms_key_ring_iam_policy.md)
 * [kms_secret](kms_secret.md)
 * [kms_secret_ciphertext](kms_secret_ciphertext.md)
+* [logging_folder_settings](logging_folder_settings.md)
+* [logging_organization_settings](logging_organization_settings.md)
 * [logging_project_cmek_settings](logging_project_cmek_settings.md)
+* [logging_project_settings](logging_project_settings.md)
 * [logging_sink](logging_sink.md)
 * [monitoring_app_engine_service](monitoring_app_engine_service.md)
 * [monitoring_cluster_istio_service](monitoring_cluster_istio_service.md)
@@ -170,6 +181,7 @@ permalink: /data/
 * [monitoring_notification_channel](monitoring_notification_channel.md)
 * [monitoring_uptime_check_ips](monitoring_uptime_check_ips.md)
 * [netblock_ip_ranges](netblock_ip_ranges.md)
+* [network_security_address_group_iam_policy](network_security_address_group_iam_policy.md)
 * [notebooks_instance_iam_policy](notebooks_instance_iam_policy.md)
 * [notebooks_runtime_iam_policy](notebooks_runtime_iam_policy.md)
 * [organization](organization.md)
@@ -182,6 +194,7 @@ permalink: /data/
 * [project_organization_policy](project_organization_policy.md)
 * [project_service](project_service.md)
 * [projects](projects.md)
+* [pubsub_schema_iam_policy](pubsub_schema_iam_policy.md)
 * [pubsub_subscription](pubsub_subscription.md)
 * [pubsub_subscription_iam_policy](pubsub_subscription_iam_policy.md)
 * [pubsub_topic](pubsub_topic.md)
@@ -192,6 +205,8 @@ permalink: /data/
 * [secret_manager_secret_iam_policy](secret_manager_secret_iam_policy.md)
 * [secret_manager_secret_version](secret_manager_secret_version.md)
 * [secret_manager_secret_version_access](secret_manager_secret_version_access.md)
+* [secret_manager_secrets](secret_manager_secrets.md)
+* [secure_source_manager_instance_iam_policy](secure_source_manager_instance_iam_policy.md)
 * [service_account](service_account.md)
 * [service_account_access_token](service_account_access_token.md)
 * [service_account_iam_policy](service_account_iam_policy.md)
@@ -225,4 +240,15 @@ permalink: /data/
 * [tags_tag_value_iam_policy](tags_tag_value_iam_policy.md)
 * [tpu_tensorflow_versions](tpu_tensorflow_versions.md)
 * [vertex_ai_index](vertex_ai_index.md)
-* [vpc_access_connector](vpc_access_connector.md)
\ No newline at end of file
+* [vmwareengine_cluster](vmwareengine_cluster.md)
+* [vmwareengine_external_access_rule](vmwareengine_external_access_rule.md)
+* [vmwareengine_external_address](vmwareengine_external_address.md)
+* [vmwareengine_network](vmwareengine_network.md)
+* [vmwareengine_network_peering](vmwareengine_network_peering.md)
+* [vmwareengine_network_policy](vmwareengine_network_policy.md)
+* [vmwareengine_nsx_credentials](vmwareengine_nsx_credentials.md)
+* [vmwareengine_private_cloud](vmwareengine_private_cloud.md)
+* [vmwareengine_subnet](vmwareengine_subnet.md)
+* [vmwareengine_vcenter_credentials](vmwareengine_vcenter_credentials.md)
+* [vpc_access_connector](vpc_access_connector.md)
+* [workbench_instance_iam_policy](workbench_instance_iam_policy.md)
\ No newline at end of file
diff --git a/docs/4.x/data/logging_folder_settings.md b/docs/4.x/data/logging_folder_settings.md
new file mode 100644
index 00000000..7e0602c0
--- /dev/null
+++ b/docs/4.x/data/logging_folder_settings.md
@@ -0,0 +1,92 @@
+---
+permalink: /data/logging_folder_settings/
+---
+
+# data.logging_folder_settings
+
+`logging_folder_settings` represents the `google_logging_folder_settings` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withFolder()`](#fn-withfolder)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.logging_folder_settings.new` injects a new `data_google_logging_folder_settings` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.logging_folder_settings.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.logging_folder_settings` using the reference:
+
+    $._ref.data_google_logging_folder_settings.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_logging_folder_settings.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `folder` (`string`): The folder for which to retrieve settings.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.logging_folder_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_folder_settings`
+Terraform data source.
+
+Unlike [google.data.logging_folder_settings.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `folder` (`string`): The folder for which to retrieve settings.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `logging_folder_settings` data source into the root Terraform configuration.
+
+
+### fn withFolder
+
+```ts
+withFolder()
+```
+
+`google.string.withFolder` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the folder field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `folder` field.
diff --git a/docs/4.x/data/logging_organization_settings.md b/docs/4.x/data/logging_organization_settings.md
new file mode 100644
index 00000000..dfe39501
--- /dev/null
+++ b/docs/4.x/data/logging_organization_settings.md
@@ -0,0 +1,92 @@
+---
+permalink: /data/logging_organization_settings/
+---
+
+# data.logging_organization_settings
+
+`logging_organization_settings` represents the `google_logging_organization_settings` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withOrganization()`](#fn-withorganization)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.logging_organization_settings.new` injects a new `data_google_logging_organization_settings` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.logging_organization_settings.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.logging_organization_settings` using the reference:
+
+    $._ref.data_google_logging_organization_settings.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_logging_organization_settings.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `organization` (`string`): The organization for which to retrieve settings.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.logging_organization_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_organization_settings`
+Terraform data source.
+
+Unlike [google.data.logging_organization_settings.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `organization` (`string`): The organization for which to retrieve settings.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `logging_organization_settings` data source into the root Terraform configuration.
+
+
+### fn withOrganization
+
+```ts
+withOrganization()
+```
+
+`google.string.withOrganization` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the organization field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `organization` field.
diff --git a/docs/4.x/data/logging_project_settings.md b/docs/4.x/data/logging_project_settings.md
new file mode 100644
index 00000000..0bc9dee6
--- /dev/null
+++ b/docs/4.x/data/logging_project_settings.md
@@ -0,0 +1,92 @@
+---
+permalink: /data/logging_project_settings/
+---
+
+# data.logging_project_settings
+
+`logging_project_settings` represents the `google_logging_project_settings` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.logging_project_settings.new` injects a new `data_google_logging_project_settings` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.logging_project_settings.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.logging_project_settings` using the reference:
+
+    $._ref.data_google_logging_project_settings.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_logging_project_settings.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `project` (`string`): The project for which to retrieve settings.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.logging_project_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_settings`
+Terraform data source.
+
+Unlike [google.data.logging_project_settings.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `project` (`string`): The project for which to retrieve settings.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `logging_project_settings` data source into the root Terraform configuration.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/network_security_address_group_iam_policy.md b/docs/4.x/data/network_security_address_group_iam_policy.md
new file mode 100644
index 00000000..4a517847
--- /dev/null
+++ b/docs/4.x/data/network_security_address_group_iam_policy.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/network_security_address_group_iam_policy/
+---
+
+# data.network_security_address_group_iam_policy
+
+`network_security_address_group_iam_policy` represents the `google_network_security_address_group_iam_policy` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.network_security_address_group_iam_policy.new` injects a new `data_google_network_security_address_group_iam_policy` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.network_security_address_group_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.network_security_address_group_iam_policy` using the reference:
+
+    $._ref.data_google_network_security_address_group_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_network_security_address_group_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting data source block.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.network_security_address_group_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_policy`
+Terraform data source.
+
+Unlike [google.data.network_security_address_group_iam_policy.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `network_security_address_group_iam_policy` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/pubsub_schema_iam_policy.md b/docs/4.x/data/pubsub_schema_iam_policy.md
new file mode 100644
index 00000000..576ec84c
--- /dev/null
+++ b/docs/4.x/data/pubsub_schema_iam_policy.md
@@ -0,0 +1,111 @@
+---
+permalink: /data/pubsub_schema_iam_policy/
+---
+
+# data.pubsub_schema_iam_policy
+
+`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withSchema()`](#fn-withschema)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.pubsub_schema_iam_policy.new` injects a new `data_google_pubsub_schema_iam_policy` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.pubsub_schema_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.pubsub_schema_iam_policy` using the reference:
+
+    $._ref.data_google_pubsub_schema_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_pubsub_schema_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting data source block.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`
+Terraform data source.
+
+Unlike [google.data.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pubsub_schema_iam_policy` data source into the root Terraform configuration.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withSchema
+
+```ts
+withSchema()
+```
+
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the schema field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `schema` field.
diff --git a/docs/4.x/data/secret_manager_secrets.md b/docs/4.x/data/secret_manager_secrets.md
new file mode 100644
index 00000000..10babf87
--- /dev/null
+++ b/docs/4.x/data/secret_manager_secrets.md
@@ -0,0 +1,113 @@
+---
+permalink: /data/secret_manager_secrets/
+---
+
+# data.secret_manager_secrets
+
+`secret_manager_secrets` represents the `google_secret_manager_secrets` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withFilter()`](#fn-withfilter)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.secret_manager_secrets.new` injects a new `data_google_secret_manager_secrets` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.secret_manager_secrets.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.secret_manager_secrets` using the reference:
+
+    $._ref.data_google_secret_manager_secrets.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_secret_manager_secrets.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).
+List only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.secret_manager_secrets.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secrets`
+Terraform data source.
+
+Unlike [google.data.secret_manager_secrets.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).
+List only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `secret_manager_secrets` data source into the root Terraform configuration.
+
+
+### fn withFilter
+
+```ts
+withFilter()
+```
+
+`google.string.withFilter` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the filter field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `filter` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/secure_source_manager_instance_iam_policy.md b/docs/4.x/data/secure_source_manager_instance_iam_policy.md
new file mode 100644
index 00000000..26d6a001
--- /dev/null
+++ b/docs/4.x/data/secure_source_manager_instance_iam_policy.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/secure_source_manager_instance_iam_policy/
+---
+
+# data.secure_source_manager_instance_iam_policy
+
+`secure_source_manager_instance_iam_policy` represents the `google_secure_source_manager_instance_iam_policy` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withInstanceId()`](#fn-withinstanceid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.secure_source_manager_instance_iam_policy.new` injects a new `data_google_secure_source_manager_instance_iam_policy` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.secure_source_manager_instance_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.secure_source_manager_instance_iam_policy` using the reference:
+
+    $._ref.data_google_secure_source_manager_instance_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_secure_source_manager_instance_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting data source block.
+  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.secure_source_manager_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_policy`
+Terraform data source.
+
+Unlike [google.data.secure_source_manager_instance_iam_policy.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `secure_source_manager_instance_iam_policy` data source into the root Terraform configuration.
+
+
+### fn withInstanceId
+
+```ts
+withInstanceId()
+```
+
+`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the instance_id field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `instance_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/vmwareengine_cluster.md b/docs/4.x/data/vmwareengine_cluster.md
new file mode 100644
index 00000000..08bf5060
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_cluster.md
@@ -0,0 +1,115 @@
+---
+permalink: /data/vmwareengine_cluster/
+---
+
+# data.vmwareengine_cluster
+
+`vmwareengine_cluster` represents the `google_vmwareengine_cluster` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_cluster.new` injects a new `data_google_vmwareengine_cluster` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_cluster` using the reference:
+
+    $._ref.data_google_vmwareengine_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): The ID of the Cluster.
+  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_cluster`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_cluster.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): The ID of the Cluster.
+  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_cluster` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the parent field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
diff --git a/docs/4.x/data/vmwareengine_external_access_rule.md b/docs/4.x/data/vmwareengine_external_access_rule.md
new file mode 100644
index 00000000..a150deaf
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_external_access_rule.md
@@ -0,0 +1,115 @@
+---
+permalink: /data/vmwareengine_external_access_rule/
+---
+
+# data.vmwareengine_external_access_rule
+
+`vmwareengine_external_access_rule` represents the `google_vmwareengine_external_access_rule` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_external_access_rule.new` injects a new `data_google_vmwareengine_external_access_rule` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_external_access_rule.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_external_access_rule` using the reference:
+
+    $._ref.data_google_vmwareengine_external_access_rule.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_external_access_rule.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): The ID of the external access rule.
+  - `parent` (`string`): The resource name of the network policy.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_external_access_rule.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_access_rule`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_external_access_rule.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): The ID of the external access rule.
+  - `parent` (`string`): The resource name of the network policy.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_external_access_rule` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the parent field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
diff --git a/docs/4.x/data/vmwareengine_external_address.md b/docs/4.x/data/vmwareengine_external_address.md
new file mode 100644
index 00000000..a0b8ad7b
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_external_address.md
@@ -0,0 +1,115 @@
+---
+permalink: /data/vmwareengine_external_address/
+---
+
+# data.vmwareengine_external_address
+
+`vmwareengine_external_address` represents the `google_vmwareengine_external_address` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_external_address.new` injects a new `data_google_vmwareengine_external_address` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_external_address.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_external_address` using the reference:
+
+    $._ref.data_google_vmwareengine_external_address.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_external_address.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): The ID of the external IP Address.
+  - `parent` (`string`): The resource name of the private cloud to create a new external address in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_external_address.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_address`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_external_address.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): The ID of the external IP Address.
+  - `parent` (`string`): The resource name of the private cloud to create a new external address in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_external_address` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the parent field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
diff --git a/docs/4.x/data/vmwareengine_network.md b/docs/4.x/data/vmwareengine_network.md
new file mode 100644
index 00000000..482212f9
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_network.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/vmwareengine_network/
+---
+
+# data.vmwareengine_network
+
+`vmwareengine_network` represents the `google_vmwareengine_network` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_network.new` injects a new `data_google_vmwareengine_network` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_network.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_network` using the reference:
+
+    $._ref.data_google_vmwareengine_network.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_network.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The location where the VMwareEngineNetwork should reside.
+  - `name` (`string`): The ID of the VMwareEngineNetwork.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_network.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_network.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The location where the VMwareEngineNetwork should reside.
+  - `name` (`string`): The ID of the VMwareEngineNetwork.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_network` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/vmwareengine_network_peering.md b/docs/4.x/data/vmwareengine_network_peering.md
new file mode 100644
index 00000000..eb6afdfd
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_network_peering.md
@@ -0,0 +1,111 @@
+---
+permalink: /data/vmwareengine_network_peering/
+---
+
+# data.vmwareengine_network_peering
+
+`vmwareengine_network_peering` represents the `google_vmwareengine_network_peering` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_network_peering.new` injects a new `data_google_vmwareengine_network_peering` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_network_peering.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_network_peering` using the reference:
+
+    $._ref.data_google_vmwareengine_network_peering.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_network_peering.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): The ID of the Network Peering.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_network_peering.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_peering`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_network_peering.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): The ID of the Network Peering.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_network_peering` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/vmwareengine_network_policy.md b/docs/4.x/data/vmwareengine_network_policy.md
new file mode 100644
index 00000000..93cd4ad0
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_network_policy.md
@@ -0,0 +1,134 @@
+---
+permalink: /data/vmwareengine_network_policy/
+---
+
+# data.vmwareengine_network_policy
+
+`vmwareengine_network_policy` represents the `google_vmwareengine_network_policy` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_network_policy.new` injects a new `data_google_vmwareengine_network_policy` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_network_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_network_policy` using the reference:
+
+    $._ref.data_google_vmwareengine_network_policy.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_network_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The resource name of the location (region) to create the new network policy in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-central1
+  - `name` (`string`): The ID of the Network Policy.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_network_policy.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_policy`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_network_policy.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The resource name of the location (region) to create the new network policy in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-central1
+  - `name` (`string`): The ID of the Network Policy.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_network_policy` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/vmwareengine_nsx_credentials.md b/docs/4.x/data/vmwareengine_nsx_credentials.md
new file mode 100644
index 00000000..42e2e408
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_nsx_credentials.md
@@ -0,0 +1,96 @@
+---
+permalink: /data/vmwareengine_nsx_credentials/
+---
+
+# data.vmwareengine_nsx_credentials
+
+`vmwareengine_nsx_credentials` represents the `google_vmwareengine_nsx_credentials` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withParent()`](#fn-withparent)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_nsx_credentials.new` injects a new `data_google_vmwareengine_nsx_credentials` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_nsx_credentials.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_nsx_credentials` using the reference:
+
+    $._ref.data_google_vmwareengine_nsx_credentials.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_nsx_credentials.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `parent` (`string`): The resource name of the private cloud which contains NSX.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_nsx_credentials.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_nsx_credentials`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_nsx_credentials.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `parent` (`string`): The resource name of the private cloud which contains NSX.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_nsx_credentials` data source into the root Terraform configuration.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the parent field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
diff --git a/docs/4.x/data/vmwareengine_private_cloud.md b/docs/4.x/data/vmwareengine_private_cloud.md
new file mode 100644
index 00000000..e0fa5d84
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_private_cloud.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/vmwareengine_private_cloud/
+---
+
+# data.vmwareengine_private_cloud
+
+`vmwareengine_private_cloud` represents the `google_vmwareengine_private_cloud` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_private_cloud.new` injects a new `data_google_vmwareengine_private_cloud` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_private_cloud.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_private_cloud` using the reference:
+
+    $._ref.data_google_vmwareengine_private_cloud.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_private_cloud.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The location where the PrivateCloud should reside.
+  - `name` (`string`): The ID of the PrivateCloud.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_private_cloud.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_private_cloud`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_private_cloud.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The location where the PrivateCloud should reside.
+  - `name` (`string`): The ID of the PrivateCloud.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_private_cloud` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/vmwareengine_subnet.md b/docs/4.x/data/vmwareengine_subnet.md
new file mode 100644
index 00000000..0b925780
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_subnet.md
@@ -0,0 +1,117 @@
+---
+permalink: /data/vmwareengine_subnet/
+---
+
+# data.vmwareengine_subnet
+
+`vmwareengine_subnet` represents the `google_vmwareengine_subnet` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_subnet.new` injects a new `data_google_vmwareengine_subnet` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_subnet.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_subnet` using the reference:
+
+    $._ref.data_google_vmwareengine_subnet.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_subnet.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of "service-n",
+where n ranges from 1 to 5.
+  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_subnet.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_subnet`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_subnet.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of "service-n",
+where n ranges from 1 to 5.
+  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_subnet` data source into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the parent field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
diff --git a/docs/4.x/data/vmwareengine_vcenter_credentials.md b/docs/4.x/data/vmwareengine_vcenter_credentials.md
new file mode 100644
index 00000000..80ded08b
--- /dev/null
+++ b/docs/4.x/data/vmwareengine_vcenter_credentials.md
@@ -0,0 +1,96 @@
+---
+permalink: /data/vmwareengine_vcenter_credentials/
+---
+
+# data.vmwareengine_vcenter_credentials
+
+`vmwareengine_vcenter_credentials` represents the `google_vmwareengine_vcenter_credentials` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withParent()`](#fn-withparent)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.vmwareengine_vcenter_credentials.new` injects a new `data_google_vmwareengine_vcenter_credentials` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.vmwareengine_vcenter_credentials.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.vmwareengine_vcenter_credentials` using the reference:
+
+    $._ref.data_google_vmwareengine_vcenter_credentials.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_vmwareengine_vcenter_credentials.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `parent` (`string`): The resource name of the private cloud which contains vcenter.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.vmwareengine_vcenter_credentials.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_vcenter_credentials`
+Terraform data source.
+
+Unlike [google.data.vmwareengine_vcenter_credentials.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `parent` (`string`): The resource name of the private cloud which contains vcenter.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `vmwareengine_vcenter_credentials` data source into the root Terraform configuration.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the parent field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
diff --git a/docs/4.x/data/cloudiot_registry_iam_policy.md b/docs/4.x/data/workbench_instance_iam_policy.md
similarity index 63%
rename from docs/4.x/data/cloudiot_registry_iam_policy.md
rename to docs/4.x/data/workbench_instance_iam_policy.md
index 0968c511..df3182f1 100644
--- a/docs/4.x/data/cloudiot_registry_iam_policy.md
+++ b/docs/4.x/data/workbench_instance_iam_policy.md
@@ -1,10 +1,10 @@
 ---
-permalink: /data/cloudiot_registry_iam_policy/
+permalink: /data/workbench_instance_iam_policy/
 ---
 
-# data.cloudiot_registry_iam_policy
+# data.workbench_instance_iam_policy
 
-`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform data source.
+`workbench_instance_iam_policy` represents the `google_workbench_instance_iam_policy` Terraform data source.
 
 
 
@@ -15,9 +15,9 @@ This package contains functions and utilities for setting up the data source usi
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 
 ## Fields
 
@@ -28,29 +28,29 @@ new()
 ```
 
 
-`google.data.cloudiot_registry_iam_policy.new` injects a new `data_google_cloudiot_registry_iam_policy` Terraform `data source`
+`google.data.workbench_instance_iam_policy.new` injects a new `data_google_workbench_instance_iam_policy` Terraform `data source`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.data.cloudiot_registry_iam_policy.new('some_id')
+    google.data.workbench_instance_iam_policy.new('some_id')
 
-You can get the reference to the `id` field of the created `google.data.cloudiot_registry_iam_policy` using the reference:
+You can get the reference to the `id` field of the created `google.data.workbench_instance_iam_policy` using the reference:
 
-    $._ref.data_google_cloudiot_registry_iam_policy.some_id.get('id')
+    $._ref.data_google_workbench_instance_iam_policy.some_id.get('id')
 
-This is the same as directly entering `"${ data_google_cloudiot_registry_iam_policy.some_id.id }"` as the value.
+This is the same as directly entering `"${ data_google_workbench_instance_iam_policy.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting data source block.
   - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting data source block. When `null`, the `region` field will be omitted from the resulting object.
 
 **Returns**:
 - A mixin object that injects the new data source into the root Terraform configuration.
@@ -63,10 +63,10 @@ newAttrs()
 ```
 
 
-`google.data.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`
+`google.data.workbench_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_policy`
 Terraform data source.
 
-Unlike [google.data.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `data source`
+Unlike [google.data.workbench_instance_iam_policy.new](#fn-new), this function will not inject the `data source`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
 
@@ -74,57 +74,57 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloudiot_registry_iam_policy` data source into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `workbench_instance_iam_policy` data source into the root Terraform configuration.
 
 
-### fn withName
+### fn withLocation
 
 ```ts
-withName()
+withLocation()
 ```
 
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the name field.
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
 
 
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
+  - `value` (`string`): The value to set for the `location` field.
 
 
-### fn withProject
+### fn withName
 
 ```ts
-withProject()
+withName()
 ```
 
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the project field.
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
 
 
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
+  - `value` (`string`): The value to set for the `name` field.
 
 
-### fn withRegion
+### fn withProject
 
 ```ts
-withRegion()
+withProject()
 ```
 
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the region field.
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
 
 
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data_catalog_taxonomy.md b/docs/4.x/data_catalog_taxonomy.md
index 1321e564..6d356aa4 100644
--- a/docs/4.x/data_catalog_taxonomy.md
+++ b/docs/4.x/data_catalog_taxonomy.md
@@ -60,6 +60,7 @@ defaults to an empty list. Possible values: ["POLICY_TYPE_UNSPECIFIED",
 tabs, newlines, carriage returns and page breaks; and be at most 2000 bytes
 long when encoded in UTF-8. If not set, defaults to an empty description. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User defined name of this taxonomy.
+The taxonomy display name must be unique within an organization.
 It must: contain only unicode letters, numbers, underscores, dashes
 and spaces; not start or end with spaces; and be at most 200 bytes
 long when encoded in UTF-8.
@@ -95,6 +96,7 @@ defaults to an empty list. Possible values: ["POLICY_TYPE_UNSPECIFIED",
 tabs, newlines, carriage returns and page breaks; and be at most 2000 bytes
 long when encoded in UTF-8. If not set, defaults to an empty description. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User defined name of this taxonomy.
+The taxonomy display name must be unique within an organization.
 It must: contain only unicode letters, numbers, underscores, dashes
 and spaces; not start or end with spaces; and be at most 200 bytes
 long when encoded in UTF-8.
diff --git a/docs/4.x/data_fusion_instance.md b/docs/4.x/data_fusion_instance.md
index eb0e6fb2..b32cf9af 100644
--- a/docs/4.x/data_fusion_instance.md
+++ b/docs/4.x/data_fusion_instance.md
@@ -87,7 +87,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.
   - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.
   - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,
-such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.
   - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.
   - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to
@@ -145,7 +149,11 @@ injecting into a complete block.
   - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.
   - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.
   - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,
-such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.
   - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.
   - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to
diff --git a/docs/4.x/data_loss_prevention_job_trigger.md b/docs/4.x/data_loss_prevention_job_trigger.md
index 5664c898..6d052735 100644
--- a/docs/4.x/data_loss_prevention_job_trigger.md
+++ b/docs/4.x/data_loss_prevention_job_trigger.md
@@ -456,7 +456,7 @@ Terraform sub block.
 
 **Args**:
   - `inspect_template_name` (`string`): The name of the template to run when this job is triggered. When `null`, the `inspect_template_name` field will be omitted from the resulting object.
-  - `actions` (`list[obj]`): A task to execute on the completion of a job. When `null`, the `actions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.actions.new](#fn-inspect_jobactionsnew) constructor.
+  - `actions` (`list[obj]`): Configuration block for the actions to execute on the completion of a job. Can be specified multiple times, but only one for each type. Each action block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html). When `null`, the `actions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.actions.new](#fn-inspect_jobactionsnew) constructor.
   - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.inspect_config.new](#fn-inspect_jobinspect_confignew) constructor.
   - `storage_config` (`list[obj]`): Information on where to inspect When `null`, the `storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.new](#fn-inspect_jobstorage_confignew) constructor.
 
@@ -1717,7 +1717,7 @@ Terraform sub block.
   - `cloud_storage_options` (`list[obj]`): Options defining a file or a set of files within a Google Cloud Storage bucket. When `null`, the `cloud_storage_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.cloud_storage_options.new](#fn-inspect_jobinspect_jobcloud_storage_optionsnew) constructor.
   - `datastore_options` (`list[obj]`): Options defining a data set within Google Cloud Datastore. When `null`, the `datastore_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.datastore_options.new](#fn-inspect_jobinspect_jobdatastore_optionsnew) constructor.
   - `hybrid_options` (`list[obj]`): Configuration to control jobs where the content being inspected is outside of Google Cloud Platform. When `null`, the `hybrid_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.hybrid_options.new](#fn-inspect_jobinspect_jobhybrid_optionsnew) constructor.
-  - `timespan_config` (`list[obj]`): Information on where to inspect When `null`, the `timespan_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.new](#fn-inspect_jobinspect_jobtimespan_confignew) constructor.
+  - `timespan_config` (`list[obj]`): Configuration of the timespan of the items to include in scanning When `null`, the `timespan_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.new](#fn-inspect_jobinspect_jobtimespan_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `storage_config` sub block.
@@ -2125,10 +2125,11 @@ Terraform sub block.
 **Args**:
   - `enable_auto_population_of_timespan_config` (`bool`): When the job is started by a JobTrigger we will automatically figure out a valid startTime to avoid
 scanning files that have not been modified since the last time the JobTrigger executed. This will
-be based on the time of the execution of the last run of the JobTrigger. When `null`, the `enable_auto_population_of_timespan_config` field will be omitted from the resulting object.
-  - `end_time` (`string`): Exclude files or rows newer than this value. If set to zero, no upper time limit is applied. When `null`, the `end_time` field will be omitted from the resulting object.
-  - `start_time` (`string`): Exclude files or rows older than this value. When `null`, the `start_time` field will be omitted from the resulting object.
-  - `timestamp_field` (`list[obj]`): Information on where to inspect When `null`, the `timestamp_field` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.timestamp_field.new](#fn-inspect_jobinspect_jobstorage_configtimestamp_fieldnew) constructor.
+be based on the time of the execution of the last run of the JobTrigger or the timespan endTime
+used in the last run of the JobTrigger. When `null`, the `enable_auto_population_of_timespan_config` field will be omitted from the resulting object.
+  - `end_time` (`string`): Exclude files, tables, or rows newer than this value. If not set, no upper time limit is applied. When `null`, the `end_time` field will be omitted from the resulting object.
+  - `start_time` (`string`): Exclude files, tables, or rows older than this value. If not set, no lower time limit is applied. When `null`, the `start_time` field will be omitted from the resulting object.
+  - `timestamp_field` (`list[obj]`): Specification of the field containing the timestamp of scanned items. When `null`, the `timestamp_field` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_job_trigger.inspect_job.storage_config.timespan_config.timestamp_field.new](#fn-inspect_jobinspect_jobstorage_configtimestamp_fieldnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `timespan_config` sub block.
diff --git a/docs/4.x/database_migration_service_connection_profile.md b/docs/4.x/database_migration_service_connection_profile.md
index 95edcae0..a5026a34 100644
--- a/docs/4.x/database_migration_service_connection_profile.md
+++ b/docs/4.x/database_migration_service_connection_profile.md
@@ -25,6 +25,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withMysql()`](#fn-withmysql)
 * [`fn withMysqlMixin()`](#fn-withmysqlmixin)
+* [`fn withOracle()`](#fn-withoracle)
+* [`fn withOracleMixin()`](#fn-withoraclemixin)
 * [`fn withPostgresql()`](#fn-withpostgresql)
 * [`fn withPostgresqlMixin()`](#fn-withpostgresqlmixin)
 * [`fn withProject()`](#fn-withproject)
@@ -52,6 +54,16 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-mysqlnew)
   * [`obj mysql.ssl`](#obj-mysqlssl)
     * [`fn new()`](#fn-mysqlsslnew)
+* [`obj oracle`](#obj-oracle)
+  * [`fn new()`](#fn-oraclenew)
+  * [`obj oracle.forward_ssh_connectivity`](#obj-oracleforward_ssh_connectivity)
+    * [`fn new()`](#fn-oracleforward_ssh_connectivitynew)
+  * [`obj oracle.private_connectivity`](#obj-oracleprivate_connectivity)
+    * [`fn new()`](#fn-oracleprivate_connectivitynew)
+  * [`obj oracle.ssl`](#obj-oraclessl)
+    * [`fn new()`](#fn-oraclesslnew)
+  * [`obj oracle.static_service_ip_connectivity`](#obj-oraclestatic_service_ip_connectivity)
+    * [`fn new()`](#fn-oraclestatic_service_ip_connectivitynew)
 * [`obj postgresql`](#obj-postgresql)
   * [`fn new()`](#fn-postgresqlnew)
   * [`obj postgresql.ssl`](#obj-postgresqlssl)
@@ -90,12 +102,17 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `connection_profile_id` (`string`): The ID of the connection profile.
   - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.
   - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.
   - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.
+  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.
   - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -123,12 +140,17 @@ injecting into a complete block.
 **Args**:
   - `connection_profile_id` (`string`): The ID of the connection profile.
   - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.
   - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.
   - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.
+  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.
   - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -311,6 +333,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `mysql` field.
 
 
+### fn withOracle
+
+```ts
+withOracle()
+```
+
+`google.list[obj].withOracle` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the oracle field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withOracleMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `oracle` field.
+
+
+### fn withOracleMixin
+
+```ts
+withOracleMixin()
+```
+
+`google.list[obj].withOracleMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the oracle field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withOracle](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `oracle` field.
+
+
 ### fn withPostgresql
 
 ```ts
@@ -697,6 +756,138 @@ If this field is used then the 'clientCertificate' field is mandatory. W
   - An attribute object that represents the `ssl` sub block.
 
 
+## obj oracle
+
+
+
+### fn oracle.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.new` constructs a new object with attributes and blocks configured for the `oracle`
+Terraform sub block.
+
+
+
+**Args**:
+  - `database_service` (`string`): Required. Database service for the Oracle connection.
+  - `host` (`string`): Required. The IP or hostname of the source Oracle database.
+  - `password` (`string`): Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.
+This field is not returned on request, and the value is encrypted when stored in Database Migration Service.
+  - `port` (`number`): Required. The network port of the source Oracle database.
+  - `username` (`string`): Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.
+  - `forward_ssh_connectivity` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new](#fn-oracleforward_ssh_connectivitynew) constructor.
+  - `private_connectivity` (`list[obj]`): Configuration for using a private network to communicate with the source database When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.private_connectivity.new](#fn-oracleprivate_connectivitynew) constructor.
+  - `ssl` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `ssl` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.ssl.new](#fn-oraclesslnew) constructor.
+  - `static_service_ip_connectivity` (`list[obj]`): This object has no nested fields.
+
+Static IP address connectivity configured on service project. When `null`, the `static_service_ip_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new](#fn-oraclestatic_service_ip_connectivitynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `oracle` sub block.
+
+
+## obj oracle.forward_ssh_connectivity
+
+
+
+### fn oracle.forward_ssh_connectivity.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new` constructs a new object with attributes and blocks configured for the `forward_ssh_connectivity`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hostname` (`string`): Required. Hostname for the SSH tunnel.
+  - `password` (`string`): Input only. SSH password. Only one of 'password' and 'private_key' can be configured. When `null`, the `password` field will be omitted from the resulting object.
+  - `port` (`number`): Port for the SSH tunnel, default value is 22.
+  - `private_key` (`string`): Input only. SSH private key. Only one of 'password' and 'private_key' can be configured. When `null`, the `private_key` field will be omitted from the resulting object.
+  - `username` (`string`): Required. Username for the SSH tunnel.
+
+**Returns**:
+  - An attribute object that represents the `forward_ssh_connectivity` sub block.
+
+
+## obj oracle.private_connectivity
+
+
+
+### fn oracle.private_connectivity.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.private_connectivity.new` constructs a new object with attributes and blocks configured for the `private_connectivity`
+Terraform sub block.
+
+
+
+**Args**:
+  - `private_connection` (`string`): Required. The resource name (URI) of the private connection.
+
+**Returns**:
+  - An attribute object that represents the `private_connectivity` sub block.
+
+
+## obj oracle.ssl
+
+
+
+### fn oracle.ssl.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.ssl.new` constructs a new object with attributes and blocks configured for the `ssl`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ca_certificate` (`string`): Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate.
+The replica will use this certificate to verify it's connecting to the right host.
+  - `client_certificate` (`string`): Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.
+If this field is used then the 'clientKey' field is mandatory When `null`, the `client_certificate` field will be omitted from the resulting object.
+  - `client_key` (`string`): Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate.
+If this field is used then the 'clientCertificate' field is mandatory. When `null`, the `client_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ssl` sub block.
+
+
+## obj oracle.static_service_ip_connectivity
+
+
+
+### fn oracle.static_service_ip_connectivity.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new` constructs a new object with attributes and blocks configured for the `static_service_ip_connectivity`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `static_service_ip_connectivity` sub block.
+
+
 ## obj postgresql
 
 
diff --git a/docs/4.x/database_migration_service_private_connection.md b/docs/4.x/database_migration_service_private_connection.md
new file mode 100644
index 00000000..ab4ca2e2
--- /dev/null
+++ b/docs/4.x/database_migration_service_private_connection.md
@@ -0,0 +1,311 @@
+---
+permalink: /database_migration_service_private_connection/
+---
+
+# database_migration_service_private_connection
+
+`database_migration_service_private_connection` represents the `google_database_migration_service_private_connection` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withPrivateConnectionId()`](#fn-withprivateconnectionid)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVpcPeeringConfig()`](#fn-withvpcpeeringconfig)
+* [`fn withVpcPeeringConfigMixin()`](#fn-withvpcpeeringconfigmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj vpc_peering_config`](#obj-vpc_peering_config)
+  * [`fn new()`](#fn-vpc_peering_confignew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_private_connection.new` injects a new `google_database_migration_service_private_connection` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.database_migration_service_private_connection.new('some_id')
+
+You can get the reference to the `id` field of the created `google.database_migration_service_private_connection` using the reference:
+
+    $._ref.google_database_migration_service_private_connection.some_id.get('id')
+
+This is the same as directly entering `"${ google_database_migration_service_private_connection.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The name of the location this private connection is located in.
+  - `private_connection_id` (`string`): The private connectivity identifier.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering
+between databasemigrationservice and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.database_migration_service_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_private_connection`
+Terraform resource.
+
+Unlike [google.database_migration_service_private_connection.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The name of the location this private connection is located in.
+  - `private_connection_id` (`string`): The private connectivity identifier.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering
+between databasemigrationservice and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_private_connection` resource into the root Terraform configuration.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withPrivateConnectionId
+
+```ts
+withPrivateConnectionId()
+```
+
+`google.string.withPrivateConnectionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the private_connection_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `private_connection_id` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVpcPeeringConfig
+
+```ts
+withVpcPeeringConfig()
+```
+
+`google.list[obj].withVpcPeeringConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_peering_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVpcPeeringConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.
+
+
+### fn withVpcPeeringConfigMixin
+
+```ts
+withVpcPeeringConfigMixin()
+```
+
+`google.list[obj].withVpcPeeringConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_peering_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVpcPeeringConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_private_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj vpc_peering_config
+
+
+
+### fn vpc_peering_config.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_private_connection.vpc_peering_config.new` constructs a new object with attributes and blocks configured for the `vpc_peering_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `subnet` (`string`): A free subnet for peering. (CIDR of /29)
+  - `vpc_name` (`string`): Fully qualified name of the VPC that Database Migration Service will peer to.
+Format: projects/{project}/global/{networks}/{name}
+
+**Returns**:
+  - An attribute object that represents the `vpc_peering_config` sub block.
diff --git a/docs/4.x/dataflow_job.md b/docs/4.x/dataflow_job.md
index c9fa9092..314883a8 100644
--- a/docs/4.x/dataflow_job.md
+++ b/docs/4.x/dataflow_job.md
@@ -73,7 +73,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.
   - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.
   - `name` (`string`): A unique name for the resource, required by Dataflow.
@@ -117,7 +118,8 @@ injecting into a complete block.
   - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.
   - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.
   - `name` (`string`): A unique name for the resource, required by Dataflow.
diff --git a/docs/4.x/dataplex_asset.md b/docs/4.x/dataplex_asset.md
index bd2b5cdc..4cb93140 100644
--- a/docs/4.x/dataplex_asset.md
+++ b/docs/4.x/dataplex_asset.md
@@ -72,7 +72,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `dataplex_zone` (`string`): The zone for the resource
   - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the asset.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the asset.
@@ -106,7 +109,10 @@ injecting into a complete block.
   - `dataplex_zone` (`string`): The zone for the resource
   - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the asset.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the asset.
diff --git a/docs/4.x/dataplex_datascan.md b/docs/4.x/dataplex_datascan.md
index 30c3af4f..86576a25 100644
--- a/docs/4.x/dataplex_datascan.md
+++ b/docs/4.x/dataplex_datascan.md
@@ -110,7 +110,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.
   - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the data scan should reside.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.
@@ -144,7 +148,11 @@ injecting into a complete block.
   - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.
   - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the data scan should reside.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.
diff --git a/docs/4.x/dataplex_lake.md b/docs/4.x/dataplex_lake.md
index 8eb20d76..6c30d6cb 100644
--- a/docs/4.x/dataplex_lake.md
+++ b/docs/4.x/dataplex_lake.md
@@ -61,7 +61,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User-defined labels for the lake.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the lake.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -92,7 +95,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User-defined labels for the lake.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the lake.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/dataplex_task.md b/docs/4.x/dataplex_task.md
index 6fe5170b..d25bd3f3 100644
--- a/docs/4.x/dataplex_task.md
+++ b/docs/4.x/dataplex_task.md
@@ -90,7 +90,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the task.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.
   - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -125,7 +129,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the task.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.
   - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/dataplex_zone.md b/docs/4.x/dataplex_zone.md
index d349df2f..5bbb32da 100644
--- a/docs/4.x/dataplex_zone.md
+++ b/docs/4.x/dataplex_zone.md
@@ -71,7 +71,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the zone.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the zone.
@@ -105,7 +108,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the zone.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the zone.
diff --git a/docs/4.x/dataproc_cluster.md b/docs/4.x/dataproc_cluster.md
index 65be6c2b..dc3a0522 100644
--- a/docs/4.x/dataproc_cluster.md
+++ b/docs/4.x/dataproc_cluster.md
@@ -30,6 +30,16 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-cluster_confignew)
   * [`obj cluster_config.autoscaling_config`](#obj-cluster_configautoscaling_config)
     * [`fn new()`](#fn-cluster_configautoscaling_confignew)
+  * [`obj cluster_config.auxiliary_node_groups`](#obj-cluster_configauxiliary_node_groups)
+    * [`fn new()`](#fn-cluster_configauxiliary_node_groupsnew)
+    * [`obj cluster_config.auxiliary_node_groups.node_group`](#obj-cluster_configauxiliary_node_groupsnode_group)
+      * [`fn new()`](#fn-cluster_configauxiliary_node_groupsnode_groupnew)
+      * [`obj cluster_config.auxiliary_node_groups.node_group.node_group_config`](#obj-cluster_configauxiliary_node_groupsnode_groupnode_group_config)
+        * [`fn new()`](#fn-cluster_configauxiliary_node_groupsnode_groupnode_group_confignew)
+        * [`obj cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators`](#obj-cluster_configauxiliary_node_groupsnode_groupnode_group_configaccelerators)
+          * [`fn new()`](#fn-cluster_configauxiliary_node_groupsnode_groupnode_group_configacceleratorsnew)
+        * [`obj cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config`](#obj-cluster_configauxiliary_node_groupsnode_groupnode_group_configdisk_config)
+          * [`fn new()`](#fn-cluster_configauxiliary_node_groupsnode_groupnode_group_configdisk_confignew)
   * [`obj cluster_config.dataproc_metric_config`](#obj-cluster_configdataproc_metric_config)
     * [`fn new()`](#fn-cluster_configdataproc_metric_confignew)
     * [`obj cluster_config.dataproc_metric_config.metrics`](#obj-cluster_configdataproc_metric_configmetrics)
@@ -62,6 +72,10 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-cluster_configpreemptible_worker_confignew)
     * [`obj cluster_config.preemptible_worker_config.disk_config`](#obj-cluster_configpreemptible_worker_configdisk_config)
       * [`fn new()`](#fn-cluster_configpreemptible_worker_configdisk_confignew)
+    * [`obj cluster_config.preemptible_worker_config.instance_flexibility_policy`](#obj-cluster_configpreemptible_worker_configinstance_flexibility_policy)
+      * [`fn new()`](#fn-cluster_configpreemptible_worker_configinstance_flexibility_policynew)
+      * [`obj cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list`](#obj-cluster_configpreemptible_worker_configinstance_flexibility_policyinstance_selection_list)
+        * [`fn new()`](#fn-cluster_configpreemptible_worker_configinstance_flexibility_policyinstance_selection_listnew)
   * [`obj cluster_config.security_config`](#obj-cluster_configsecurity_config)
     * [`fn new()`](#fn-cluster_configsecurity_confignew)
     * [`obj cluster_config.security_config.kerberos_config`](#obj-cluster_configsecurity_configkerberos_config)
@@ -129,7 +143,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and zone.
   - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.
@@ -160,7 +177,10 @@ injecting into a complete block.
 
 **Args**:
   - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and zone.
   - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.
@@ -382,18 +402,19 @@ Terraform sub block.
   - `staging_bucket` (`string`): The Cloud Storage staging bucket used to stage files, such as Hadoop jars, between client machines and the cluster. Note: If you don't explicitly specify a staging_bucket then GCP will auto create / assign one for you. However, you are not guaranteed an auto generated bucket which is solely dedicated to your cluster; it may be shared with other clusters in the same region/zone also choosing to use the auto generation option. When `null`, the `staging_bucket` field will be omitted from the resulting object.
   - `temp_bucket` (`string`): The Cloud Storage temp bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. Note: If you don't explicitly specify a temp_bucket then GCP will auto create / assign one for you. When `null`, the `temp_bucket` field will be omitted from the resulting object.
   - `autoscaling_config` (`list[obj]`): The autoscaling policy config associated with the cluster. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.autoscaling_config.new](#fn-cluster_configautoscaling_confignew) constructor.
+  - `auxiliary_node_groups` (`list[obj]`): The node group settings. When `null`, the `auxiliary_node_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.new](#fn-cluster_configauxiliary_node_groupsnew) constructor.
   - `dataproc_metric_config` (`list[obj]`): The config for Dataproc metrics. When `null`, the `dataproc_metric_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.dataproc_metric_config.new](#fn-cluster_configdataproc_metric_confignew) constructor.
   - `encryption_config` (`list[obj]`): The Customer managed encryption keys settings for the cluster. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.encryption_config.new](#fn-cluster_configencryption_confignew) constructor.
   - `endpoint_config` (`list[obj]`): The config settings for port access on the cluster. Structure defined below. When `null`, the `endpoint_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.endpoint_config.new](#fn-cluster_configendpoint_confignew) constructor.
   - `gce_cluster_config` (`list[obj]`): Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster. When `null`, the `gce_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.gce_cluster_config.new](#fn-cluster_configgce_cluster_confignew) constructor.
   - `initialization_action` (`list[obj]`): Commands to execute on each node after config is completed. You can specify multiple versions of these. When `null`, the `initialization_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.initialization_action.new](#fn-cluster_configinitialization_actionnew) constructor.
   - `lifecycle_config` (`list[obj]`): The settings for auto deletion cluster schedule. When `null`, the `lifecycle_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.lifecycle_config.new](#fn-cluster_configlifecycle_confignew) constructor.
-  - `master_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.
+  - `master_config` (`list[obj]`): The Compute Engine config settings for the cluster's master instance. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.
   - `metastore_config` (`list[obj]`): Specifies a Metastore configuration. When `null`, the `metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.metastore_config.new](#fn-cluster_configmetastore_confignew) constructor.
   - `preemptible_worker_config` (`list[obj]`): The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster. When `null`, the `preemptible_worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.new](#fn-cluster_configpreemptible_worker_confignew) constructor.
   - `security_config` (`list[obj]`): Security related configuration. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.security_config.new](#fn-cluster_configsecurity_confignew) constructor.
   - `software_config` (`list[obj]`): The config settings for software inside the cluster. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.software_config.new](#fn-cluster_configsoftware_confignew) constructor.
-  - `worker_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.
+  - `worker_config` (`list[obj]`): The Compute Engine config settings for the cluster's worker instances. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `cluster_config` sub block.
@@ -422,6 +443,130 @@ Terraform sub block.
   - An attribute object that represents the `autoscaling_config` sub block.
 
 
+## obj cluster_config.auxiliary_node_groups
+
+
+
+### fn cluster_config.auxiliary_node_groups.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.auxiliary_node_groups.new` constructs a new object with attributes and blocks configured for the `auxiliary_node_groups`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_group_id` (`string`): A node group ID. Generated if not specified. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), and hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of from 3 to 33 characters. When `null`, the `node_group_id` field will be omitted from the resulting object.
+  - `node_group` (`list[obj]`): Node group configuration. When `null`, the `node_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.new](#fn-cluster_configcluster_confignode_groupnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `auxiliary_node_groups` sub block.
+
+
+## obj cluster_config.auxiliary_node_groups.node_group
+
+
+
+### fn cluster_config.auxiliary_node_groups.node_group.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.new` constructs a new object with attributes and blocks configured for the `node_group`
+Terraform sub block.
+
+
+
+**Args**:
+  - `roles` (`list`): Node group roles.
+  - `node_group_config` (`list[obj]`): The node group instance group configuration. When `null`, the `node_group_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.new](#fn-cluster_configcluster_configauxiliary_node_groupsnode_group_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_group` sub block.
+
+
+## obj cluster_config.auxiliary_node_groups.node_group.node_group_config
+
+
+
+### fn cluster_config.auxiliary_node_groups.node_group.node_group_config.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.new` constructs a new object with attributes and blocks configured for the `node_group_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master When `null`, the `machine_type` field will be omitted from the resulting object.
+  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the auxiliary node group. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
+  - `num_instances` (`number`): Specifies the number of auxiliary nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
+  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators.new](#fn-cluster_configcluster_configauxiliary_node_groupsnode_groupacceleratorsnew) constructor.
+  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config.new](#fn-cluster_configcluster_configauxiliary_node_groupsnode_groupdisk_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_group_config` sub block.
+
+
+## obj cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators
+
+
+
+### fn cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.accelerators.new` constructs a new object with attributes and blocks configured for the `accelerators`
+Terraform sub block.
+
+
+
+**Args**:
+  - `accelerator_count` (`number`): The number of the accelerator cards of this type exposed to this instance. Often restricted to one of 1, 2, 4, or 8.
+  - `accelerator_type` (`string`): The short name of the accelerator type to expose to this instance. For example, nvidia-tesla-k80.
+
+**Returns**:
+  - An attribute object that represents the `accelerators` sub block.
+
+
+## obj cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config
+
+
+
+### fn cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.auxiliary_node_groups.node_group.node_group_config.disk_config.new` constructs a new object with attributes and blocks configured for the `disk_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boot_disk_size_gb` (`number`): Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.
+  - `boot_disk_type` (`string`): The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard". When `null`, the `boot_disk_type` field will be omitted from the resulting object.
+  - `num_local_ssds` (`number`): The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0. When `null`, the `num_local_ssds` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `disk_config` sub block.
+
+
 ## obj cluster_config.dataproc_metric_config
 
 
@@ -686,10 +831,10 @@ Terraform sub block.
 
 
 **Args**:
-  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.
-  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.
-  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
-  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
+  - `image_uri` (`string`): The URI for the image to use for this master When `null`, the `image_uri` field will be omitted from the resulting object.
+  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master When `null`, the `machine_type` field will be omitted from the resulting object.
+  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
+  - `num_instances` (`number`): Specifies the number of master nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
   - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.
   - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.
 
@@ -789,6 +934,7 @@ Terraform sub block.
   - `num_instances` (`number`): Specifies the number of preemptible nodes to create. Defaults to 0. When `null`, the `num_instances` field will be omitted from the resulting object.
   - `preemptibility` (`string`): Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE. When `null`, the `preemptibility` field will be omitted from the resulting object.
   - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.
+  - `instance_flexibility_policy` (`list[obj]`): Instance flexibility Policy allowing a mixture of VM shapes and provisioning models. When `null`, the `instance_flexibility_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new](#fn-cluster_configcluster_configinstance_flexibility_policynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `preemptible_worker_config` sub block.
@@ -819,6 +965,53 @@ Terraform sub block.
   - An attribute object that represents the `disk_config` sub block.
 
 
+## obj cluster_config.preemptible_worker_config.instance_flexibility_policy
+
+
+
+### fn cluster_config.preemptible_worker_config.instance_flexibility_policy.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new` constructs a new object with attributes and blocks configured for the `instance_flexibility_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `instance_selection_list` (`list[obj]`): List of instance selection options that the group will use when creating new VMs. When `null`, the `instance_selection_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new](#fn-cluster_configcluster_configpreemptible_worker_configinstance_selection_listnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `instance_flexibility_policy` sub block.
+
+
+## obj cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list
+
+
+
+### fn cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new` constructs a new object with attributes and blocks configured for the `instance_selection_list`
+Terraform sub block.
+
+
+
+**Args**:
+  - `machine_types` (`list`): Full machine-type names, e.g. "n1-standard-16". When `null`, the `machine_types` field will be omitted from the resulting object.
+  - `rank` (`number`): Preference of this instance selection. Lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference. When `null`, the `rank` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `instance_selection_list` sub block.
+
+
 ## obj cluster_config.security_config
 
 
@@ -927,7 +1120,8 @@ Terraform sub block.
   - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.
   - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.
   - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
-  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
+  - `min_num_instances` (`number`): The minimum number of primary worker instances to create. When `null`, the `min_num_instances` field will be omitted from the resulting object.
+  - `num_instances` (`number`): Specifies the number of worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
   - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.
   - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.
 
diff --git a/docs/4.x/dataproc_job.md b/docs/4.x/dataproc_job.md
index 5628996a..b403acca 100644
--- a/docs/4.x/dataproc_job.md
+++ b/docs/4.x/dataproc_job.md
@@ -106,7 +106,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this job.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.
   - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.
@@ -144,7 +147,10 @@ injecting into a complete block.
 
 **Args**:
   - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this job.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.
   - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.
diff --git a/docs/4.x/dataproc_metastore_service.md b/docs/4.x/dataproc_metastore_service.md
index 90b54aec..b3080bb5 100644
--- a/docs/4.x/dataproc_metastore_service.md
+++ b/docs/4.x/dataproc_metastore_service.md
@@ -24,6 +24,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withMaintenanceWindow()`](#fn-withmaintenancewindow)
 * [`fn withMaintenanceWindowMixin()`](#fn-withmaintenancewindowmixin)
+* [`fn withMetadataIntegration()`](#fn-withmetadataintegration)
+* [`fn withMetadataIntegrationMixin()`](#fn-withmetadataintegrationmixin)
 * [`fn withNetwork()`](#fn-withnetwork)
 * [`fn withNetworkConfig()`](#fn-withnetworkconfig)
 * [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
@@ -42,12 +44,18 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-encryption_confignew)
 * [`obj hive_metastore_config`](#obj-hive_metastore_config)
   * [`fn new()`](#fn-hive_metastore_confignew)
+  * [`obj hive_metastore_config.auxiliary_versions`](#obj-hive_metastore_configauxiliary_versions)
+    * [`fn new()`](#fn-hive_metastore_configauxiliary_versionsnew)
   * [`obj hive_metastore_config.kerberos_config`](#obj-hive_metastore_configkerberos_config)
     * [`fn new()`](#fn-hive_metastore_configkerberos_confignew)
     * [`obj hive_metastore_config.kerberos_config.keytab`](#obj-hive_metastore_configkerberos_configkeytab)
       * [`fn new()`](#fn-hive_metastore_configkerberos_configkeytabnew)
 * [`obj maintenance_window`](#obj-maintenance_window)
   * [`fn new()`](#fn-maintenance_windownew)
+* [`obj metadata_integration`](#obj-metadata_integration)
+  * [`fn new()`](#fn-metadata_integrationnew)
+  * [`obj metadata_integration.data_catalog_config`](#obj-metadata_integrationdata_catalog_config)
+    * [`fn new()`](#fn-metadata_integrationdata_catalog_confignew)
 * [`obj network_config`](#obj-network_config)
   * [`fn new()`](#fn-network_confignew)
   * [`obj network_config.consumers`](#obj-network_configconsumers)
@@ -89,7 +97,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the metastore service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the metastore service should reside.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
@@ -108,6 +119,7 @@ customer data at rest. When `null`, the `encryption_config` sub block will be om
   - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.
 This specifies when the service can be restarted for maintenance purposes in UTC time.
 Maintenance window is not needed for services with the 'SPANNER' database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.
+  - `metadata_integration` (`list[obj]`): The setting that defines how metastore metadata should be integrated with external services and systems. When `null`, the `metadata_integration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.metadata_integration.new](#fn-metadata_integrationnew) constructor.
   - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.
   - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.
   - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.
@@ -136,7 +148,10 @@ injecting into a complete block.
 
 **Args**:
   - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the metastore service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the metastore service should reside.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
@@ -155,6 +170,7 @@ customer data at rest. When `null`, the `encryption_config` sub block will be om
   - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.
 This specifies when the service can be restarted for maintenance purposes in UTC time.
 Maintenance window is not needed for services with the 'SPANNER' database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.
+  - `metadata_integration` (`list[obj]`): The setting that defines how metastore metadata should be integrated with external services and systems. When `null`, the `metadata_integration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.metadata_integration.new](#fn-metadata_integrationnew) constructor.
   - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.
   - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.
   - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.
@@ -323,6 +339,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `maintenance_window` field.
 
 
+### fn withMetadataIntegration
+
+```ts
+withMetadataIntegration()
+```
+
+`google.list[obj].withMetadataIntegration` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the metadata_integration field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMetadataIntegrationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `metadata_integration` field.
+
+
+### fn withMetadataIntegrationMixin
+
+```ts
+withMetadataIntegrationMixin()
+```
+
+`google.list[obj].withMetadataIntegrationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the metadata_integration field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMetadataIntegration](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `metadata_integration` field.
+
+
 ### fn withNetwork
 
 ```ts
@@ -609,13 +662,45 @@ Terraform sub block.
 **Args**:
   - `config_overrides` (`obj`): A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml).
 The mappings override system defaults (some keys cannot be overridden) When `null`, the `config_overrides` field will be omitted from the resulting object.
+  - `endpoint_protocol` (`string`): The protocol to use for the metastore service endpoint. If unspecified, defaults to 'THRIFT'. Default value: "THRIFT" Possible values: ["THRIFT", "GRPC"] When `null`, the `endpoint_protocol` field will be omitted from the resulting object.
   - `version` (`string`): The Hive metastore schema version.
+  - `auxiliary_versions` (`list[obj]`): A mapping of Hive metastore version to the auxiliary version configuration.
+When specified, a secondary Hive metastore service is created along with the primary service.
+All auxiliary versions must be less than the service's primary version.
+The key is the auxiliary service name and it must match the regular expression a-z?.
+This means that the first character must be a lowercase letter, and all the following characters must be hyphens, lowercase letters, or digits, except the last character, which cannot be a hyphen. When `null`, the `auxiliary_versions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.auxiliary_versions.new](#fn-hive_metastore_configauxiliary_versionsnew) constructor.
   - `kerberos_config` (`list[obj]`): Information used to configure the Hive metastore service as a service principal in a Kerberos realm. When `null`, the `kerberos_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.kerberos_config.new](#fn-hive_metastore_configkerberos_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `hive_metastore_config` sub block.
 
 
+## obj hive_metastore_config.auxiliary_versions
+
+
+
+### fn hive_metastore_config.auxiliary_versions.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_metastore_service.hive_metastore_config.auxiliary_versions.new` constructs a new object with attributes and blocks configured for the `auxiliary_versions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `config_overrides` (`obj`): A mapping of Hive metastore configuration key-value pairs to apply to the auxiliary Hive metastore (configured in hive-site.xml) in addition to the primary version's overrides.
+If keys are present in both the auxiliary version's overrides and the primary version's overrides, the value from the auxiliary version's overrides takes precedence. When `null`, the `config_overrides` field will be omitted from the resulting object.
+  - `key` (`string`): Set the `key` field on the resulting object.
+  - `version` (`string`): The Hive metastore version of the auxiliary service. It must be less than the primary Hive metastore service's version.
+
+**Returns**:
+  - An attribute object that represents the `auxiliary_versions` sub block.
+
+
 ## obj hive_metastore_config.kerberos_config
 
 
@@ -690,6 +775,52 @@ Terraform sub block.
   - An attribute object that represents the `maintenance_window` sub block.
 
 
+## obj metadata_integration
+
+
+
+### fn metadata_integration.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_metastore_service.metadata_integration.new` constructs a new object with attributes and blocks configured for the `metadata_integration`
+Terraform sub block.
+
+
+
+**Args**:
+  - `data_catalog_config` (`list[obj]`): The integration config for the Data Catalog service. When `null`, the `data_catalog_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.metadata_integration.data_catalog_config.new](#fn-metadata_integrationdata_catalog_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `metadata_integration` sub block.
+
+
+## obj metadata_integration.data_catalog_config
+
+
+
+### fn metadata_integration.data_catalog_config.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_metastore_service.metadata_integration.data_catalog_config.new` constructs a new object with attributes and blocks configured for the `data_catalog_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Defines whether the metastore metadata should be synced to Data Catalog. The default value is to disable syncing metastore metadata to Data Catalog.
+
+**Returns**:
+  - An attribute object that represents the `data_catalog_config` sub block.
+
+
 ## obj network_config
 
 
diff --git a/docs/4.x/dataproc_workflow_template.md b/docs/4.x/dataproc_workflow_template.md
index e274141f..6270f081 100644
--- a/docs/4.x/dataproc_workflow_template.md
+++ b/docs/4.x/dataproc_workflow_template.md
@@ -162,7 +162,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -195,7 +198,10 @@ injecting into a complete block.
 
 **Args**:
   - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -1762,6 +1768,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/datastream_connection_profile.md b/docs/4.x/datastream_connection_profile.md
index edf355c2..0b6e106e 100644
--- a/docs/4.x/datastream_connection_profile.md
+++ b/docs/4.x/datastream_connection_profile.md
@@ -86,7 +86,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `connection_profile_id` (`string`): The connection profile identifier.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this connection profile is located in.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.
@@ -122,7 +125,10 @@ injecting into a complete block.
 **Args**:
   - `connection_profile_id` (`string`): The connection profile identifier.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this connection profile is located in.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.
diff --git a/docs/4.x/datastream_private_connection.md b/docs/4.x/datastream_private_connection.md
index 43863635..9678ae23 100644
--- a/docs/4.x/datastream_private_connection.md
+++ b/docs/4.x/datastream_private_connection.md
@@ -59,7 +59,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this private connection is located in.
   - `private_connection_id` (`string`): The private connectivity identifier.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -90,7 +93,10 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this private connection is located in.
   - `private_connection_id` (`string`): The private connectivity identifier.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -274,6 +280,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/datastream_stream.md b/docs/4.x/datastream_stream.md
index 9704cf29..efced10f 100644
--- a/docs/4.x/datastream_stream.md
+++ b/docs/4.x/datastream_stream.md
@@ -172,7 +172,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 will be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.
   - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this stream is located in.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `stream_id` (`string`): The stream identifier.
@@ -208,7 +211,10 @@ injecting into a complete block.
 will be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.
   - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this stream is located in.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `stream_id` (`string`): The stream identifier.
diff --git a/docs/4.x/dialogflow_cx_agent.md b/docs/4.x/dialogflow_cx_agent.md
index d85c62d7..e0cc86db 100644
--- a/docs/4.x/dialogflow_cx_agent.md
+++ b/docs/4.x/dialogflow_cx_agent.md
@@ -15,23 +15,41 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdvancedSettings()`](#fn-withadvancedsettings)
+* [`fn withAdvancedSettingsMixin()`](#fn-withadvancedsettingsmixin)
 * [`fn withAvatarUri()`](#fn-withavataruri)
 * [`fn withDefaultLanguageCode()`](#fn-withdefaultlanguagecode)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEnableSpellCorrection()`](#fn-withenablespellcorrection)
 * [`fn withEnableStackdriverLogging()`](#fn-withenablestackdriverlogging)
+* [`fn withGitIntegrationSettings()`](#fn-withgitintegrationsettings)
+* [`fn withGitIntegrationSettingsMixin()`](#fn-withgitintegrationsettingsmixin)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withSecuritySettings()`](#fn-withsecuritysettings)
 * [`fn withSpeechToTextSettings()`](#fn-withspeechtotextsettings)
 * [`fn withSpeechToTextSettingsMixin()`](#fn-withspeechtotextsettingsmixin)
 * [`fn withSupportedLanguageCodes()`](#fn-withsupportedlanguagecodes)
+* [`fn withTextToSpeechSettings()`](#fn-withtexttospeechsettings)
+* [`fn withTextToSpeechSettingsMixin()`](#fn-withtexttospeechsettingsmixin)
 * [`fn withTimeZone()`](#fn-withtimezone)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj advanced_settings`](#obj-advanced_settings)
+  * [`fn new()`](#fn-advanced_settingsnew)
+  * [`obj advanced_settings.audio_export_gcs_destination`](#obj-advanced_settingsaudio_export_gcs_destination)
+    * [`fn new()`](#fn-advanced_settingsaudio_export_gcs_destinationnew)
+  * [`obj advanced_settings.dtmf_settings`](#obj-advanced_settingsdtmf_settings)
+    * [`fn new()`](#fn-advanced_settingsdtmf_settingsnew)
+* [`obj git_integration_settings`](#obj-git_integration_settings)
+  * [`fn new()`](#fn-git_integration_settingsnew)
+  * [`obj git_integration_settings.github_settings`](#obj-git_integration_settingsgithub_settings)
+    * [`fn new()`](#fn-git_integration_settingsgithub_settingsnew)
 * [`obj speech_to_text_settings`](#obj-speech_to_text_settings)
   * [`fn new()`](#fn-speech_to_text_settingsnew)
+* [`obj text_to_speech_settings`](#obj-text_to_speech_settings)
+  * [`fn new()`](#fn-text_to_speech_settingsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -81,7 +99,11 @@ for a list of the currently supported language codes. This field cannot be updat
   - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.
   - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,
 Europe/Paris.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.
+  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.
   - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.
+  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -123,13 +145,54 @@ for a list of the currently supported language codes. This field cannot be updat
   - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.
   - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,
 Europe/Paris.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.
+  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.
   - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.
+  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_agent` resource into the root Terraform configuration.
 
 
+### fn withAdvancedSettings
+
+```ts
+withAdvancedSettings()
+```
+
+`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
+### fn withAdvancedSettingsMixin
+
+```ts
+withAdvancedSettingsMixin()
+```
+
+`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
 ### fn withAvatarUri
 
 ```ts
@@ -226,6 +289,43 @@ Terraform resource block to set or update the enable_stackdriver_logging field.
   - `value` (`bool`): The value to set for the `enable_stackdriver_logging` field.
 
 
+### fn withGitIntegrationSettings
+
+```ts
+withGitIntegrationSettings()
+```
+
+`google.list[obj].withGitIntegrationSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the git_integration_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withGitIntegrationSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.
+
+
+### fn withGitIntegrationSettingsMixin
+
+```ts
+withGitIntegrationSettingsMixin()
+```
+
+`google.list[obj].withGitIntegrationSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the git_integration_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withGitIntegrationSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.
+
+
 ### fn withLocation
 
 ```ts
@@ -327,6 +427,43 @@ Terraform resource block to set or update the supported_language_codes field.
   - `value` (`list`): The value to set for the `supported_language_codes` field.
 
 
+### fn withTextToSpeechSettings
+
+```ts
+withTextToSpeechSettings()
+```
+
+`google.list[obj].withTextToSpeechSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the text_to_speech_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withTextToSpeechSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.
+
+
+### fn withTextToSpeechSettingsMixin
+
+```ts
+withTextToSpeechSettingsMixin()
+```
+
+`google.list[obj].withTextToSpeechSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the text_to_speech_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withTextToSpeechSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.
+
+
 ### fn withTimeZone
 
 ```ts
@@ -379,6 +516,135 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj advanced_settings
+
+
+
+### fn advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:
+* Agent level
+* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj advanced_settings.audio_export_gcs_destination
+
+
+
+### fn advanced_settings.audio_export_gcs_destination.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`
+Terraform sub block.
+
+
+
+**Args**:
+  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.
+Format: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `audio_export_gcs_destination` sub block.
+
+
+## obj advanced_settings.dtmf_settings
+
+
+
+### fn advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
+## obj git_integration_settings
+
+
+
+### fn git_integration_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.git_integration_settings.new` constructs a new object with attributes and blocks configured for the `git_integration_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `github_settings` (`list[obj]`): Settings of integration with GitHub. When `null`, the `github_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.github_settings.new](#fn-git_integration_settingsgithub_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `git_integration_settings` sub block.
+
+
+## obj git_integration_settings.github_settings
+
+
+
+### fn git_integration_settings.github_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.git_integration_settings.github_settings.new` constructs a new object with attributes and blocks configured for the `github_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_token` (`string`): The access token used to authenticate the access to the GitHub repository. When `null`, the `access_token` field will be omitted from the resulting object.
+  - `branches` (`list`): A list of branches configured to be used from Dialogflow. When `null`, the `branches` field will be omitted from the resulting object.
+  - `display_name` (`string`): The unique repository display name for the GitHub repository. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `repository_uri` (`string`): The GitHub repository URI related to the agent. When `null`, the `repository_uri` field will be omitted from the resulting object.
+  - `tracking_branch` (`string`): The branch of the GitHub repository tracked for this agent. When `null`, the `tracking_branch` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `github_settings` sub block.
+
+
 ## obj speech_to_text_settings
 
 
@@ -402,6 +668,32 @@ Terraform sub block.
   - An attribute object that represents the `speech_to_text_settings` sub block.
 
 
+## obj text_to_speech_settings
+
+
+
+### fn text_to_speech_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.text_to_speech_settings.new` constructs a new object with attributes and blocks configured for the `text_to_speech_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `synthesize_speech_configs` (`string`): Configuration of how speech should be synthesized, mapping from [language](https://cloud.google.com/dialogflow/cx/docs/reference/language) to [SynthesizeSpeechConfig](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents#synthesizespeechconfig).
+These settings affect:
+* The phone gateway synthesize configuration set via Agent.text_to_speech_settings.
+* How speech is synthesized when invoking session APIs. 'Agent.text_to_speech_settings' only applies if 'OutputAudioConfig.synthesize_speech_config' is not specified. When `null`, the `synthesize_speech_configs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `text_to_speech_settings` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/dialogflow_cx_flow.md b/docs/4.x/dialogflow_cx_flow.md
index 166f0907..e319a29f 100644
--- a/docs/4.x/dialogflow_cx_flow.md
+++ b/docs/4.x/dialogflow_cx_flow.md
@@ -15,10 +15,13 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdvancedSettings()`](#fn-withadvancedsettings)
+* [`fn withAdvancedSettingsMixin()`](#fn-withadvancedsettingsmixin)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEventHandlers()`](#fn-witheventhandlers)
 * [`fn withEventHandlersMixin()`](#fn-witheventhandlersmixin)
+* [`fn withIsDefaultStartFlow()`](#fn-withisdefaultstartflow)
 * [`fn withLanguageCode()`](#fn-withlanguagecode)
 * [`fn withNluSettings()`](#fn-withnlusettings)
 * [`fn withNluSettingsMixin()`](#fn-withnlusettingsmixin)
@@ -28,6 +31,12 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTransitionRouteGroups()`](#fn-withtransitionroutegroups)
 * [`fn withTransitionRoutes()`](#fn-withtransitionroutes)
 * [`fn withTransitionRoutesMixin()`](#fn-withtransitionroutesmixin)
+* [`obj advanced_settings`](#obj-advanced_settings)
+  * [`fn new()`](#fn-advanced_settingsnew)
+  * [`obj advanced_settings.audio_export_gcs_destination`](#obj-advanced_settingsaudio_export_gcs_destination)
+    * [`fn new()`](#fn-advanced_settingsaudio_export_gcs_destinationnew)
+  * [`obj advanced_settings.dtmf_settings`](#obj-advanced_settingsdtmf_settings)
+    * [`fn new()`](#fn-advanced_settingsdtmf_settingsnew)
 * [`obj event_handlers`](#obj-event_handlers)
   * [`fn new()`](#fn-event_handlersnew)
   * [`obj event_handlers.trigger_fulfillment`](#obj-event_handlerstrigger_fulfillment)
@@ -108,6 +117,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable name of the flow.
+  - `is_default_start_flow` (`bool`): Marks this as the [Default Start Flow](https://cloud.google.com/dialogflow/cx/docs/concept/flow#start) for an agent. When you create an agent, the Default Start Flow is created automatically.
+The Default Start Flow cannot be deleted; deleting the 'google_dialogflow_cx_flow' resource does nothing to the underlying GCP resources.
+
+~> Avoid having multiple 'google_dialogflow_cx_flow' resources linked to the same agent with 'is_default_start_flow = true' because they will compete to control a single Default Start Flow resource in GCP. When `null`, the `is_default_start_flow` field will be omitted from the resulting object.
   - `language_code` (`string`): The language of the following fields in flow:
 Flow.event_handlers.trigger_fulfillment.messages
 Flow.event_handlers.trigger_fulfillment.conditional_cases
@@ -120,6 +133,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 They are responsible for matching the user's first utterances in the flow.
 They are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:
 They are responsible for handling events (e.g. no match, webhook errors) in the flow.
 They are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.
@@ -159,6 +174,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable name of the flow.
+  - `is_default_start_flow` (`bool`): Marks this as the [Default Start Flow](https://cloud.google.com/dialogflow/cx/docs/concept/flow#start) for an agent. When you create an agent, the Default Start Flow is created automatically.
+The Default Start Flow cannot be deleted; deleting the 'google_dialogflow_cx_flow' resource does nothing to the underlying GCP resources.
+
+~> Avoid having multiple 'google_dialogflow_cx_flow' resources linked to the same agent with 'is_default_start_flow = true' because they will compete to control a single Default Start Flow resource in GCP. When `null`, the `is_default_start_flow` field will be omitted from the resulting object.
   - `language_code` (`string`): The language of the following fields in flow:
 Flow.event_handlers.trigger_fulfillment.messages
 Flow.event_handlers.trigger_fulfillment.conditional_cases
@@ -171,6 +190,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 They are responsible for matching the user's first utterances in the flow.
 They are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:
 They are responsible for handling events (e.g. no match, webhook errors) in the flow.
 They are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.
@@ -190,6 +211,43 @@ TransitionRoutes are evalauted in the following order:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_flow` resource into the root Terraform configuration.
 
 
+### fn withAdvancedSettings
+
+```ts
+withAdvancedSettings()
+```
+
+`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
+### fn withAdvancedSettingsMixin
+
+```ts
+withAdvancedSettingsMixin()
+```
+
+`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -259,6 +317,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `event_handlers` field.
 
 
+### fn withIsDefaultStartFlow
+
+```ts
+withIsDefaultStartFlow()
+```
+
+`google.bool.withIsDefaultStartFlow` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the is_default_start_flow field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `is_default_start_flow` field.
+
+
 ### fn withLanguageCode
 
 ```ts
@@ -417,6 +491,85 @@ function.
   - `value` (`list[obj]`): The value to set for the `transition_routes` field.
 
 
+## obj advanced_settings
+
+
+
+### fn advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_flow.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:
+* Agent level
+* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj advanced_settings.audio_export_gcs_destination
+
+
+
+### fn advanced_settings.audio_export_gcs_destination.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`
+Terraform sub block.
+
+
+
+**Args**:
+  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.
+Format: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `audio_export_gcs_destination` sub block.
+
+
+## obj advanced_settings.dtmf_settings
+
+
+
+### fn advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
 ## obj event_handlers
 
 
diff --git a/docs/4.x/dialogflow_cx_intent.md b/docs/4.x/dialogflow_cx_intent.md
index 0c554f6b..449065bf 100644
--- a/docs/4.x/dialogflow_cx_intent.md
+++ b/docs/4.x/dialogflow_cx_intent.md
@@ -17,6 +17,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withIsDefaultNegativeIntent()`](#fn-withisdefaultnegativeintent)
+* [`fn withIsDefaultWelcomeIntent()`](#fn-withisdefaultwelcomeintent)
 * [`fn withIsFallback()`](#fn-withisfallback)
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withLanguageCode()`](#fn-withlanguagecode)
@@ -68,11 +70,24 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable name of the intent, unique within the agent.
+  - `is_default_negative_intent` (`bool`): Marks this as the [Default Negative Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#negative) for an agent. When you create an agent, a Default Negative Intent is created automatically.
+The Default Negative Intent cannot be deleted; deleting the 'google_dialogflow_cx_intent' resource does nothing to the underlying GCP resources.
+
+~> Avoid having multiple 'google_dialogflow_cx_intent' resources linked to the same agent with 'is_default_negative_intent = true' because they will compete to control a single Default Negative Intent resource in GCP. When `null`, the `is_default_negative_intent` field will be omitted from the resulting object.
+  - `is_default_welcome_intent` (`bool`): Marks this as the [Default Welcome Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#welcome) for an agent. When you create an agent, a Default Welcome Intent is created automatically.
+The Default Welcome Intent cannot be deleted; deleting the 'google_dialogflow_cx_intent' resource does nothing to the underlying GCP resources.
+
+~> Avoid having multiple 'google_dialogflow_cx_intent' resources linked to the same agent with 'is_default_welcome_intent = true' because they will compete to control a single Default Welcome Intent resource in GCP. When `null`, the `is_default_welcome_intent` field will be omitted from the resulting object.
   - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.
-Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.
+Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.
+To manage the fallback intent, set 'is_default_negative_intent = true' When `null`, the `is_fallback` field will be omitted from the resulting object.
   - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `language_code` (`string`): The language of the following fields in intent:
 Intent.training_phrases.parts.text
 If not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.
@@ -109,11 +124,24 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable name of the intent, unique within the agent.
+  - `is_default_negative_intent` (`bool`): Marks this as the [Default Negative Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#negative) for an agent. When you create an agent, a Default Negative Intent is created automatically.
+The Default Negative Intent cannot be deleted; deleting the 'google_dialogflow_cx_intent' resource does nothing to the underlying GCP resources.
+
+~> Avoid having multiple 'google_dialogflow_cx_intent' resources linked to the same agent with 'is_default_negative_intent = true' because they will compete to control a single Default Negative Intent resource in GCP. When `null`, the `is_default_negative_intent` field will be omitted from the resulting object.
+  - `is_default_welcome_intent` (`bool`): Marks this as the [Default Welcome Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#welcome) for an agent. When you create an agent, a Default Welcome Intent is created automatically.
+The Default Welcome Intent cannot be deleted; deleting the 'google_dialogflow_cx_intent' resource does nothing to the underlying GCP resources.
+
+~> Avoid having multiple 'google_dialogflow_cx_intent' resources linked to the same agent with 'is_default_welcome_intent = true' because they will compete to control a single Default Welcome Intent resource in GCP. When `null`, the `is_default_welcome_intent` field will be omitted from the resulting object.
   - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.
-Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.
+Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.
+To manage the fallback intent, set 'is_default_negative_intent = true' When `null`, the `is_fallback` field will be omitted from the resulting object.
   - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `language_code` (`string`): The language of the following fields in intent:
 Intent.training_phrases.parts.text
 If not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.
@@ -162,6 +190,38 @@ Terraform resource block to set or update the display_name field.
   - `value` (`string`): The value to set for the `display_name` field.
 
 
+### fn withIsDefaultNegativeIntent
+
+```ts
+withIsDefaultNegativeIntent()
+```
+
+`google.bool.withIsDefaultNegativeIntent` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the is_default_negative_intent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `is_default_negative_intent` field.
+
+
+### fn withIsDefaultWelcomeIntent
+
+```ts
+withIsDefaultWelcomeIntent()
+```
+
+`google.bool.withIsDefaultWelcomeIntent` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the is_default_welcome_intent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `is_default_welcome_intent` field.
+
+
 ### fn withIsFallback
 
 ```ts
diff --git a/docs/4.x/dialogflow_cx_page.md b/docs/4.x/dialogflow_cx_page.md
index 72a555cd..f4619676 100644
--- a/docs/4.x/dialogflow_cx_page.md
+++ b/docs/4.x/dialogflow_cx_page.md
@@ -15,6 +15,8 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdvancedSettings()`](#fn-withadvancedsettings)
+* [`fn withAdvancedSettingsMixin()`](#fn-withadvancedsettingsmixin)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEntryFulfillment()`](#fn-withentryfulfillment)
 * [`fn withEntryFulfillmentMixin()`](#fn-withentryfulfillmentmixin)
@@ -29,6 +31,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTransitionRouteGroups()`](#fn-withtransitionroutegroups)
 * [`fn withTransitionRoutes()`](#fn-withtransitionroutes)
 * [`fn withTransitionRoutesMixin()`](#fn-withtransitionroutesmixin)
+* [`obj advanced_settings`](#obj-advanced_settings)
+  * [`fn new()`](#fn-advanced_settingsnew)
+  * [`obj advanced_settings.dtmf_settings`](#obj-advanced_settingsdtmf_settings)
+    * [`fn new()`](#fn-advanced_settingsdtmf_settingsnew)
 * [`obj entry_fulfillment`](#obj-entry_fulfillment)
   * [`fn new()`](#fn-entry_fulfillmentnew)
   * [`obj entry_fulfillment.conditional_cases`](#obj-entry_fulfillmentconditional_cases)
@@ -75,6 +81,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-formnew)
   * [`obj form.parameters`](#obj-formparameters)
     * [`fn new()`](#fn-formparametersnew)
+    * [`obj form.parameters.advanced_settings`](#obj-formparametersadvanced_settings)
+      * [`fn new()`](#fn-formparametersadvanced_settingsnew)
+      * [`obj form.parameters.advanced_settings.dtmf_settings`](#obj-formparametersadvanced_settingsdtmf_settings)
+        * [`fn new()`](#fn-formparametersadvanced_settingsdtmf_settingsnew)
     * [`obj form.parameters.fill_behavior`](#obj-formparametersfill_behavior)
       * [`fn new()`](#fn-formparametersfill_behaviornew)
       * [`obj form.parameters.fill_behavior.initial_prompt_fulfillment`](#obj-formparametersfill_behaviorinitial_prompt_fulfillment)
@@ -193,6 +203,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 If multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.
 If multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.
   - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.
   - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.
@@ -248,6 +260,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 If multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.
 If multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.
   - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.
   - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.
@@ -265,6 +279,43 @@ TransitionRoutes defined in the transition route groups with only condition spec
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_page` resource into the root Terraform configuration.
 
 
+### fn withAdvancedSettings
+
+```ts
+withAdvancedSettings()
+```
+
+`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
+### fn withAdvancedSettingsMixin
+
+```ts
+withAdvancedSettingsMixin()
+```
+
+`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
 ### fn withDisplayName
 
 ```ts
@@ -513,6 +564,58 @@ function.
   - `value` (`list[obj]`): The value to set for the `transition_routes` field.
 
 
+## obj advanced_settings
+
+
+
+### fn advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj advanced_settings.dtmf_settings
+
+
+
+### fn advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
 ## obj entry_fulfillment
 
 
@@ -1096,12 +1199,66 @@ Format: projects/-/locations/-/agents/-/entityTypes/<System Entity Type ID&gt
 If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled. When `null`, the `redact` field will be omitted from the resulting object.
   - `required` (`bool`): Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them.
 Required parameters must be filled before form filling concludes. When `null`, the `required` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this parameter. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.new](#fn-formformadvanced_settingsnew) constructor.
   - `fill_behavior` (`list[obj]`): Defines fill behavior for the parameter. When `null`, the `fill_behavior` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.fill_behavior.new](#fn-formformfill_behaviornew) constructor.
 
 **Returns**:
   - An attribute object that represents the `parameters` sub block.
 
 
+## obj form.parameters.advanced_settings
+
+
+
+### fn form.parameters.advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.form.parameters.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new](#fn-formformparametersdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj form.parameters.advanced_settings.dtmf_settings
+
+
+
+### fn form.parameters.advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
 ## obj form.parameters.fill_behavior
 
 
diff --git a/docs/4.x/discovery_engine_chat_engine.md b/docs/4.x/discovery_engine_chat_engine.md
new file mode 100644
index 00000000..64883ba8
--- /dev/null
+++ b/docs/4.x/discovery_engine_chat_engine.md
@@ -0,0 +1,433 @@
+---
+permalink: /discovery_engine_chat_engine/
+---
+
+# discovery_engine_chat_engine
+
+`discovery_engine_chat_engine` represents the `google_discovery_engine_chat_engine` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withChatEngineConfig()`](#fn-withchatengineconfig)
+* [`fn withChatEngineConfigMixin()`](#fn-withchatengineconfigmixin)
+* [`fn withCollectionId()`](#fn-withcollectionid)
+* [`fn withCommonConfig()`](#fn-withcommonconfig)
+* [`fn withCommonConfigMixin()`](#fn-withcommonconfigmixin)
+* [`fn withDataStoreIds()`](#fn-withdatastoreids)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEngineId()`](#fn-withengineid)
+* [`fn withIndustryVertical()`](#fn-withindustryvertical)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj chat_engine_config`](#obj-chat_engine_config)
+  * [`fn new()`](#fn-chat_engine_confignew)
+  * [`obj chat_engine_config.agent_creation_config`](#obj-chat_engine_configagent_creation_config)
+    * [`fn new()`](#fn-chat_engine_configagent_creation_confignew)
+* [`obj common_config`](#obj-common_config)
+  * [`fn new()`](#fn-common_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_chat_engine.new` injects a new `google_discovery_engine_chat_engine` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.discovery_engine_chat_engine.new('some_id')
+
+You can get the reference to the `id` field of the created `google.discovery_engine_chat_engine` using the reference:
+
+    $._ref.google_discovery_engine_chat_engine.some_id.get('id')
+
+This is the same as directly entering `"${ google_discovery_engine_chat_engine.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `collection_id` (`string`): The collection ID.
+  - `data_store_ids` (`list`): The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be 'SOLUTION_TYPE_CHAT'. Adding or removing data stores will force recreation.
+  - `display_name` (`string`): The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
+  - `engine_id` (`string`): The ID to use for chat engine.
+  - `industry_vertical` (`string`): The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked to the engine. Default value: "GENERIC" Possible values: ["GENERIC"] When `null`, the `industry_vertical` field will be omitted from the resulting object.
+  - `location` (`string`): Location.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `chat_engine_config` (`list[obj]`): Configurations for a chat Engine. When `null`, the `chat_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.chat_engine_config.new](#fn-chat_engine_confignew) constructor.
+  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.common_config.new](#fn-common_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.discovery_engine_chat_engine.newAttrs` constructs a new object with attributes and blocks configured for the `discovery_engine_chat_engine`
+Terraform resource.
+
+Unlike [google.discovery_engine_chat_engine.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `collection_id` (`string`): The collection ID.
+  - `data_store_ids` (`list`): The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be 'SOLUTION_TYPE_CHAT'. Adding or removing data stores will force recreation.
+  - `display_name` (`string`): The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
+  - `engine_id` (`string`): The ID to use for chat engine.
+  - `industry_vertical` (`string`): The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked to the engine. Default value: "GENERIC" Possible values: ["GENERIC"] When `null`, the `industry_vertical` field will be omitted from the resulting object.
+  - `location` (`string`): Location.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `chat_engine_config` (`list[obj]`): Configurations for a chat Engine. When `null`, the `chat_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.chat_engine_config.new](#fn-chat_engine_confignew) constructor.
+  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.common_config.new](#fn-common_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `discovery_engine_chat_engine` resource into the root Terraform configuration.
+
+
+### fn withChatEngineConfig
+
+```ts
+withChatEngineConfig()
+```
+
+`google.list[obj].withChatEngineConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the chat_engine_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withChatEngineConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `chat_engine_config` field.
+
+
+### fn withChatEngineConfigMixin
+
+```ts
+withChatEngineConfigMixin()
+```
+
+`google.list[obj].withChatEngineConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the chat_engine_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withChatEngineConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `chat_engine_config` field.
+
+
+### fn withCollectionId
+
+```ts
+withCollectionId()
+```
+
+`google.string.withCollectionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the collection_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `collection_id` field.
+
+
+### fn withCommonConfig
+
+```ts
+withCommonConfig()
+```
+
+`google.list[obj].withCommonConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the common_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCommonConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `common_config` field.
+
+
+### fn withCommonConfigMixin
+
+```ts
+withCommonConfigMixin()
+```
+
+`google.list[obj].withCommonConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the common_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCommonConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `common_config` field.
+
+
+### fn withDataStoreIds
+
+```ts
+withDataStoreIds()
+```
+
+`google.list.withDataStoreIds` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the data_store_ids field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `data_store_ids` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEngineId
+
+```ts
+withEngineId()
+```
+
+`google.string.withEngineId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the engine_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `engine_id` field.
+
+
+### fn withIndustryVertical
+
+```ts
+withIndustryVertical()
+```
+
+`google.string.withIndustryVertical` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the industry_vertical field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `industry_vertical` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj chat_engine_config
+
+
+
+### fn chat_engine_config.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_chat_engine.chat_engine_config.new` constructs a new object with attributes and blocks configured for the `chat_engine_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `agent_creation_config` (`list[obj]`): The configuration to generate the Dialogflow agent that is associated to this Engine. When `null`, the `agent_creation_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_chat_engine.chat_engine_config.agent_creation_config.new](#fn-chat_engine_configagent_creation_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `chat_engine_config` sub block.
+
+
+## obj chat_engine_config.agent_creation_config
+
+
+
+### fn chat_engine_config.agent_creation_config.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_chat_engine.chat_engine_config.agent_creation_config.new` constructs a new object with attributes and blocks configured for the `agent_creation_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `business` (`string`): Name of the company, organization or other entity that the agent represents. Used for knowledge connector LLM prompt and for knowledge search. When `null`, the `business` field will be omitted from the resulting object.
+  - `default_language_code` (`string`): The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/docs/reference/language) for a list of the currently supported language codes.
+  - `location` (`string`): Agent location for Agent creation, currently supported values: global/us/eu, it needs to be the same region as the Chat Engine. When `null`, the `location` field will be omitted from the resulting object.
+  - `time_zone` (`string`): The time zone of the agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris.
+
+**Returns**:
+  - An attribute object that represents the `agent_creation_config` sub block.
+
+
+## obj common_config
+
+
+
+### fn common_config.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_chat_engine.common_config.new` constructs a new object with attributes and blocks configured for the `common_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `company_name` (`string`): The name of the company, business or entity that is associated with the engine. Setting this may help improve LLM related features. When `null`, the `company_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `common_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_chat_engine.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/discovery_engine_data_store.md b/docs/4.x/discovery_engine_data_store.md
new file mode 100644
index 00000000..00e6a0ac
--- /dev/null
+++ b/docs/4.x/discovery_engine_data_store.md
@@ -0,0 +1,300 @@
+---
+permalink: /discovery_engine_data_store/
+---
+
+# discovery_engine_data_store
+
+`discovery_engine_data_store` represents the `google_discovery_engine_data_store` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withContentConfig()`](#fn-withcontentconfig)
+* [`fn withCreateAdvancedSiteSearch()`](#fn-withcreateadvancedsitesearch)
+* [`fn withDataStoreId()`](#fn-withdatastoreid)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withIndustryVertical()`](#fn-withindustryvertical)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withSolutionTypes()`](#fn-withsolutiontypes)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_data_store.new` injects a new `google_discovery_engine_data_store` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.discovery_engine_data_store.new('some_id')
+
+You can get the reference to the `id` field of the created `google.discovery_engine_data_store` using the reference:
+
+    $._ref.google_discovery_engine_data_store.some_id.get('id')
+
+This is the same as directly entering `"${ google_discovery_engine_data_store.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `content_config` (`string`): The content config of the data store. Possible values: ["NO_CONTENT", "CONTENT_REQUIRED", "PUBLIC_WEBSITE"]
+  - `create_advanced_site_search` (`bool`): If true, an advanced data store for site search will be created. If the
+data store is not configured as site search (GENERIC vertical and
+PUBLIC_WEBSITE contentConfig), this flag will be ignored. When `null`, the `create_advanced_site_search` field will be omitted from the resulting object.
+  - `data_store_id` (`string`): The unique id of the data store.
+  - `display_name` (`string`): The display name of the data store. This field must be a UTF-8 encoded
+string with a length limit of 128 characters.
+  - `industry_vertical` (`string`): The industry vertical that the data store registers. Possible values: ["GENERIC", "MEDIA"]
+  - `location` (`string`): The geographic location where the data store should reside. The value can
+only be one of "global", "us" and "eu".
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `solution_types` (`list`): The solutions that the data store enrolls. Possible values: ["SOLUTION_TYPE_RECOMMENDATION", "SOLUTION_TYPE_SEARCH", "SOLUTION_TYPE_CHAT"] When `null`, the `solution_types` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_data_store.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.discovery_engine_data_store.newAttrs` constructs a new object with attributes and blocks configured for the `discovery_engine_data_store`
+Terraform resource.
+
+Unlike [google.discovery_engine_data_store.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `content_config` (`string`): The content config of the data store. Possible values: ["NO_CONTENT", "CONTENT_REQUIRED", "PUBLIC_WEBSITE"]
+  - `create_advanced_site_search` (`bool`): If true, an advanced data store for site search will be created. If the
+data store is not configured as site search (GENERIC vertical and
+PUBLIC_WEBSITE contentConfig), this flag will be ignored. When `null`, the `create_advanced_site_search` field will be omitted from the resulting object.
+  - `data_store_id` (`string`): The unique id of the data store.
+  - `display_name` (`string`): The display name of the data store. This field must be a UTF-8 encoded
+string with a length limit of 128 characters.
+  - `industry_vertical` (`string`): The industry vertical that the data store registers. Possible values: ["GENERIC", "MEDIA"]
+  - `location` (`string`): The geographic location where the data store should reside. The value can
+only be one of "global", "us" and "eu".
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `solution_types` (`list`): The solutions that the data store enrolls. Possible values: ["SOLUTION_TYPE_RECOMMENDATION", "SOLUTION_TYPE_SEARCH", "SOLUTION_TYPE_CHAT"] When `null`, the `solution_types` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_data_store.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `discovery_engine_data_store` resource into the root Terraform configuration.
+
+
+### fn withContentConfig
+
+```ts
+withContentConfig()
+```
+
+`google.string.withContentConfig` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the content_config field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `content_config` field.
+
+
+### fn withCreateAdvancedSiteSearch
+
+```ts
+withCreateAdvancedSiteSearch()
+```
+
+`google.bool.withCreateAdvancedSiteSearch` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the create_advanced_site_search field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `create_advanced_site_search` field.
+
+
+### fn withDataStoreId
+
+```ts
+withDataStoreId()
+```
+
+`google.string.withDataStoreId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the data_store_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `data_store_id` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withIndustryVertical
+
+```ts
+withIndustryVertical()
+```
+
+`google.string.withIndustryVertical` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the industry_vertical field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `industry_vertical` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withSolutionTypes
+
+```ts
+withSolutionTypes()
+```
+
+`google.list.withSolutionTypes` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the solution_types field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `solution_types` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_data_store.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/discovery_engine_search_engine.md b/docs/4.x/discovery_engine_search_engine.md
new file mode 100644
index 00000000..af33dc34
--- /dev/null
+++ b/docs/4.x/discovery_engine_search_engine.md
@@ -0,0 +1,406 @@
+---
+permalink: /discovery_engine_search_engine/
+---
+
+# discovery_engine_search_engine
+
+`discovery_engine_search_engine` represents the `google_discovery_engine_search_engine` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCollectionId()`](#fn-withcollectionid)
+* [`fn withCommonConfig()`](#fn-withcommonconfig)
+* [`fn withCommonConfigMixin()`](#fn-withcommonconfigmixin)
+* [`fn withDataStoreIds()`](#fn-withdatastoreids)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEngineId()`](#fn-withengineid)
+* [`fn withIndustryVertical()`](#fn-withindustryvertical)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withSearchEngineConfig()`](#fn-withsearchengineconfig)
+* [`fn withSearchEngineConfigMixin()`](#fn-withsearchengineconfigmixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj common_config`](#obj-common_config)
+  * [`fn new()`](#fn-common_confignew)
+* [`obj search_engine_config`](#obj-search_engine_config)
+  * [`fn new()`](#fn-search_engine_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_search_engine.new` injects a new `google_discovery_engine_search_engine` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.discovery_engine_search_engine.new('some_id')
+
+You can get the reference to the `id` field of the created `google.discovery_engine_search_engine` using the reference:
+
+    $._ref.google_discovery_engine_search_engine.some_id.get('id')
+
+This is the same as directly entering `"${ google_discovery_engine_search_engine.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `collection_id` (`string`): The collection ID.
+  - `data_store_ids` (`list`): The data stores associated with this engine. For SOLUTION_TYPE_SEARCH type of engines, they can only associate with at most one data store.
+  - `display_name` (`string`): Required. The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
+  - `engine_id` (`string`): Unique ID to use for Search Engine App.
+  - `industry_vertical` (`string`): The industry vertical that the engine registers. The restriction of the Engine industry vertical is based on DataStore: If unspecified, default to GENERIC. Vertical on Engine has to match vertical of the DataStore liniked to the engine. Default value: "GENERIC" Possible values: ["GENERIC", "MEDIA"] When `null`, the `industry_vertical` field will be omitted from the resulting object.
+  - `location` (`string`): Location.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.common_config.new](#fn-common_confignew) constructor.
+  - `search_engine_config` (`list[obj]`): Configurations for a Search Engine. When `null`, the `search_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.search_engine_config.new](#fn-search_engine_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.discovery_engine_search_engine.newAttrs` constructs a new object with attributes and blocks configured for the `discovery_engine_search_engine`
+Terraform resource.
+
+Unlike [google.discovery_engine_search_engine.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `collection_id` (`string`): The collection ID.
+  - `data_store_ids` (`list`): The data stores associated with this engine. For SOLUTION_TYPE_SEARCH type of engines, they can only associate with at most one data store.
+  - `display_name` (`string`): Required. The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
+  - `engine_id` (`string`): Unique ID to use for Search Engine App.
+  - `industry_vertical` (`string`): The industry vertical that the engine registers. The restriction of the Engine industry vertical is based on DataStore: If unspecified, default to GENERIC. Vertical on Engine has to match vertical of the DataStore liniked to the engine. Default value: "GENERIC" Possible values: ["GENERIC", "MEDIA"] When `null`, the `industry_vertical` field will be omitted from the resulting object.
+  - `location` (`string`): Location.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `common_config` (`list[obj]`): Common config spec that specifies the metadata of the engine. When `null`, the `common_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.common_config.new](#fn-common_confignew) constructor.
+  - `search_engine_config` (`list[obj]`): Configurations for a Search Engine. When `null`, the `search_engine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.search_engine_config.new](#fn-search_engine_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.discovery_engine_search_engine.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `discovery_engine_search_engine` resource into the root Terraform configuration.
+
+
+### fn withCollectionId
+
+```ts
+withCollectionId()
+```
+
+`google.string.withCollectionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the collection_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `collection_id` field.
+
+
+### fn withCommonConfig
+
+```ts
+withCommonConfig()
+```
+
+`google.list[obj].withCommonConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the common_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCommonConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `common_config` field.
+
+
+### fn withCommonConfigMixin
+
+```ts
+withCommonConfigMixin()
+```
+
+`google.list[obj].withCommonConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the common_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCommonConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `common_config` field.
+
+
+### fn withDataStoreIds
+
+```ts
+withDataStoreIds()
+```
+
+`google.list.withDataStoreIds` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the data_store_ids field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `data_store_ids` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEngineId
+
+```ts
+withEngineId()
+```
+
+`google.string.withEngineId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the engine_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `engine_id` field.
+
+
+### fn withIndustryVertical
+
+```ts
+withIndustryVertical()
+```
+
+`google.string.withIndustryVertical` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the industry_vertical field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `industry_vertical` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withSearchEngineConfig
+
+```ts
+withSearchEngineConfig()
+```
+
+`google.list[obj].withSearchEngineConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the search_engine_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSearchEngineConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `search_engine_config` field.
+
+
+### fn withSearchEngineConfigMixin
+
+```ts
+withSearchEngineConfigMixin()
+```
+
+`google.list[obj].withSearchEngineConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the search_engine_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSearchEngineConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `search_engine_config` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj common_config
+
+
+
+### fn common_config.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_search_engine.common_config.new` constructs a new object with attributes and blocks configured for the `common_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `company_name` (`string`): The name of the company, business or entity that is associated with the engine. Setting this may help improve LLM related features.cd When `null`, the `company_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `common_config` sub block.
+
+
+## obj search_engine_config
+
+
+
+### fn search_engine_config.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_search_engine.search_engine_config.new` constructs a new object with attributes and blocks configured for the `search_engine_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `search_add_ons` (`list`): The add-on that this search engine enables. Possible values: ["SEARCH_ADD_ON_LLM"] When `null`, the `search_add_ons` field will be omitted from the resulting object.
+  - `search_tier` (`string`): The search feature tier of this engine. Defaults to SearchTier.SEARCH_TIER_STANDARD if not specified. Default value: "SEARCH_TIER_STANDARD" Possible values: ["SEARCH_TIER_STANDARD", "SEARCH_TIER_ENTERPRISE"] When `null`, the `search_tier` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `search_engine_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.discovery_engine_search_engine.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/dns_managed_zone.md b/docs/4.x/dns_managed_zone.md
index 587d3d6a..bec72cc8 100644
--- a/docs/4.x/dns_managed_zone.md
+++ b/docs/4.x/dns_managed_zone.md
@@ -89,7 +89,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.
   - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".
   - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): User assigned name for this resource.
 Must be unique within the project.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -131,7 +135,11 @@ injecting into a complete block.
   - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.
   - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".
   - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): User assigned name for this resource.
 Must be unique within the project.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/edgecontainer_cluster.md b/docs/4.x/edgecontainer_cluster.md
new file mode 100644
index 00000000..baaf4b83
--- /dev/null
+++ b/docs/4.x/edgecontainer_cluster.md
@@ -0,0 +1,990 @@
+---
+permalink: /edgecontainer_cluster/
+---
+
+# edgecontainer_cluster
+
+`edgecontainer_cluster` represents the `google_edgecontainer_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAuthorization()`](#fn-withauthorization)
+* [`fn withAuthorizationMixin()`](#fn-withauthorizationmixin)
+* [`fn withControlPlane()`](#fn-withcontrolplane)
+* [`fn withControlPlaneEncryption()`](#fn-withcontrolplaneencryption)
+* [`fn withControlPlaneEncryptionMixin()`](#fn-withcontrolplaneencryptionmixin)
+* [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
+* [`fn withDefaultMaxPodsPerNode()`](#fn-withdefaultmaxpodspernode)
+* [`fn withExternalLoadBalancerIpv4AddressPools()`](#fn-withexternalloadbalanceripv4addresspools)
+* [`fn withFleet()`](#fn-withfleet)
+* [`fn withFleetMixin()`](#fn-withfleetmixin)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMaintenancePolicy()`](#fn-withmaintenancepolicy)
+* [`fn withMaintenancePolicyMixin()`](#fn-withmaintenancepolicymixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworking()`](#fn-withnetworking)
+* [`fn withNetworkingMixin()`](#fn-withnetworkingmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withReleaseChannel()`](#fn-withreleasechannel)
+* [`fn withSystemAddonsConfig()`](#fn-withsystemaddonsconfig)
+* [`fn withSystemAddonsConfigMixin()`](#fn-withsystemaddonsconfigmixin)
+* [`fn withTargetVersion()`](#fn-withtargetversion)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj authorization`](#obj-authorization)
+  * [`fn new()`](#fn-authorizationnew)
+  * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
+    * [`fn new()`](#fn-authorizationadmin_usersnew)
+* [`obj control_plane`](#obj-control_plane)
+  * [`fn new()`](#fn-control_planenew)
+  * [`obj control_plane.local`](#obj-control_planelocal)
+    * [`fn new()`](#fn-control_planelocalnew)
+  * [`obj control_plane.remote`](#obj-control_planeremote)
+    * [`fn new()`](#fn-control_planeremotenew)
+* [`obj control_plane_encryption`](#obj-control_plane_encryption)
+  * [`fn new()`](#fn-control_plane_encryptionnew)
+* [`obj fleet`](#obj-fleet)
+  * [`fn new()`](#fn-fleetnew)
+* [`obj maintenance_policy`](#obj-maintenance_policy)
+  * [`fn new()`](#fn-maintenance_policynew)
+  * [`obj maintenance_policy.window`](#obj-maintenance_policywindow)
+    * [`fn new()`](#fn-maintenance_policywindownew)
+    * [`obj maintenance_policy.window.recurring_window`](#obj-maintenance_policywindowrecurring_window)
+      * [`fn new()`](#fn-maintenance_policywindowrecurring_windownew)
+      * [`obj maintenance_policy.window.recurring_window.window`](#obj-maintenance_policywindowrecurring_windowwindow)
+        * [`fn new()`](#fn-maintenance_policywindowrecurring_windowwindownew)
+* [`obj networking`](#obj-networking)
+  * [`fn new()`](#fn-networkingnew)
+* [`obj system_addons_config`](#obj-system_addons_config)
+  * [`fn new()`](#fn-system_addons_confignew)
+  * [`obj system_addons_config.ingress`](#obj-system_addons_configingress)
+    * [`fn new()`](#fn-system_addons_configingressnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.new` injects a new `google_edgecontainer_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.edgecontainer_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.edgecontainer_cluster` using the reference:
+
+    $._ref.google_edgecontainer_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_edgecontainer_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not
+specified explicitly for a node pool in this cluster. If unspecified, the
+Kubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the edgecloud cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The GDCE cluster name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: ["RELEASE_CHANNEL_UNSPECIFIED", "NONE", "REGULAR"] When `null`, the `release_channel` field will be omitted from the resulting object.
+  - `target_version` (`string`): The target cluster version. For example: "1.5.0". When `null`, the `target_version` field will be omitted from the resulting object.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when
+enabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.
+  - `fleet` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.
+  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
+  - `networking` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.
+  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.edgecontainer_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_cluster`
+Terraform resource.
+
+Unlike [google.edgecontainer_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not
+specified explicitly for a node pool in this cluster. If unspecified, the
+Kubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the edgecloud cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The GDCE cluster name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: ["RELEASE_CHANNEL_UNSPECIFIED", "NONE", "REGULAR"] When `null`, the `release_channel` field will be omitted from the resulting object.
+  - `target_version` (`string`): The target cluster version. For example: "1.5.0". When `null`, the `target_version` field will be omitted from the resulting object.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when
+enabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.
+  - `fleet` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.
+  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
+  - `networking` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.
+  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_cluster` resource into the root Terraform configuration.
+
+
+### fn withAuthorization
+
+```ts
+withAuthorization()
+```
+
+`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withAuthorizationMixin
+
+```ts
+withAuthorizationMixin()
+```
+
+`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withControlPlane
+
+```ts
+withControlPlane()
+```
+
+`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withControlPlaneEncryption
+
+```ts
+withControlPlaneEncryption()
+```
+
+`google.list[obj].withControlPlaneEncryption` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_encryption field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneEncryptionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.
+
+
+### fn withControlPlaneEncryptionMixin
+
+```ts
+withControlPlaneEncryptionMixin()
+```
+
+`google.list[obj].withControlPlaneEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_encryption field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneEncryption](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.
+
+
+### fn withControlPlaneMixin
+
+```ts
+withControlPlaneMixin()
+```
+
+`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withDefaultMaxPodsPerNode
+
+```ts
+withDefaultMaxPodsPerNode()
+```
+
+`google.number.withDefaultMaxPodsPerNode` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the default_max_pods_per_node field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `default_max_pods_per_node` field.
+
+
+### fn withExternalLoadBalancerIpv4AddressPools
+
+```ts
+withExternalLoadBalancerIpv4AddressPools()
+```
+
+`google.list.withExternalLoadBalancerIpv4AddressPools` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the external_load_balancer_ipv4_address_pools field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `external_load_balancer_ipv4_address_pools` field.
+
+
+### fn withFleet
+
+```ts
+withFleet()
+```
+
+`google.list[obj].withFleet` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withFleetMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet` field.
+
+
+### fn withFleetMixin
+
+```ts
+withFleetMixin()
+```
+
+`google.list[obj].withFleetMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withFleet](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMaintenancePolicy
+
+```ts
+withMaintenancePolicy()
+```
+
+`google.list[obj].withMaintenancePolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMaintenancePolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.
+
+
+### fn withMaintenancePolicyMixin
+
+```ts
+withMaintenancePolicyMixin()
+```
+
+`google.list[obj].withMaintenancePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenancePolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworking
+
+```ts
+withNetworking()
+```
+
+`google.list[obj].withNetworking` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the networking field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkingMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `networking` field.
+
+
+### fn withNetworkingMixin
+
+```ts
+withNetworkingMixin()
+```
+
+`google.list[obj].withNetworkingMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the networking field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworking](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `networking` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withReleaseChannel
+
+```ts
+withReleaseChannel()
+```
+
+`google.string.withReleaseChannel` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the release_channel field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `release_channel` field.
+
+
+### fn withSystemAddonsConfig
+
+```ts
+withSystemAddonsConfig()
+```
+
+`google.list[obj].withSystemAddonsConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the system_addons_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSystemAddonsConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.
+
+
+### fn withSystemAddonsConfigMixin
+
+```ts
+withSystemAddonsConfigMixin()
+```
+
+`google.list[obj].withSystemAddonsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the system_addons_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSystemAddonsConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.
+
+
+### fn withTargetVersion
+
+```ts
+withTargetVersion()
+```
+
+`google.string.withTargetVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the target_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `target_version` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj authorization
+
+
+
+### fn authorization.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): User that will be granted the cluster-admin role on the cluster, providing
+full access to the cluster. Currently, this is a singular field, but will
+be expanded to allow multiple admins in the future. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj authorization.admin_users
+
+
+
+### fn authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): An active Google username.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj control_plane
+
+
+
+### fn control_plane.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`
+Terraform sub block.
+
+
+
+**Args**:
+  - `local_` (`list[obj]`): Local control plane configuration. When `null`, the `local_` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.local_.new](#fn-control_planelocal_new) constructor.
+  - `remote` (`list[obj]`): Remote control plane configuration. When `null`, the `remote` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.remote.new](#fn-control_planeremotenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane` sub block.
+
+
+## obj control_plane.local
+
+
+
+### fn control_plane.local.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane.local.new` constructs a new object with attributes and blocks configured for the `local`
+Terraform sub block.
+
+
+
+**Args**:
+  - `machine_filter` (`string`): Only machines matching this filter will be allowed to host control
+plane nodes. The filtering language accepts strings like "name=<name>",
+and is documented here: [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.
+  - `node_count` (`number`): The number of nodes to serve as replicas of the Control Plane.
+Only 1 and 3 are supported. When `null`, the `node_count` field will be omitted from the resulting object.
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool
+will be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.
+  - `shared_deployment_policy` (`string`): Policy configuration about how user applications are deployed. Possible values: ["SHARED_DEPLOYMENT_POLICY_UNSPECIFIED", "ALLOWED", "DISALLOWED"] When `null`, the `shared_deployment_policy` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `local` sub block.
+
+
+## obj control_plane.remote
+
+
+
+### fn control_plane.remote.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane.remote.new` constructs a new object with attributes and blocks configured for the `remote`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool
+will be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `remote` sub block.
+
+
+## obj control_plane_encryption
+
+
+
+### fn control_plane_encryption.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane_encryption.new` constructs a new object with attributes and blocks configured for the `control_plane_encryption`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g.
+projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}
+to use for protecting control plane disks. If not specified, a
+Google-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_encryption` sub block.
+
+
+## obj fleet
+
+
+
+### fn fleet.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.fleet.new` constructs a new object with attributes and blocks configured for the `fleet`
+Terraform sub block.
+
+
+
+**Args**:
+  - `project` (`string`): The name of the Fleet host project where this cluster will be registered.
+Project names are formatted as
+'projects/<project-number>'.
+
+**Returns**:
+  - An attribute object that represents the `fleet` sub block.
+
+
+## obj maintenance_policy
+
+
+
+### fn maintenance_policy.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.new` constructs a new object with attributes and blocks configured for the `maintenance_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `window` (`list[obj]`): Specifies the maintenance window in which maintenance may be performed. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.new](#fn-maintenance_policywindownew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `maintenance_policy` sub block.
+
+
+## obj maintenance_policy.window
+
+
+
+### fn maintenance_policy.window.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.window.new` constructs a new object with attributes and blocks configured for the `window`
+Terraform sub block.
+
+
+
+**Args**:
+  - `recurring_window` (`list[obj]`): Represents an arbitrary window of time that recurs. When `null`, the `recurring_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new](#fn-maintenance_policymaintenance_policyrecurring_windownew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `window` sub block.
+
+
+## obj maintenance_policy.window.recurring_window
+
+
+
+### fn maintenance_policy.window.recurring_window.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new` constructs a new object with attributes and blocks configured for the `recurring_window`
+Terraform sub block.
+
+
+
+**Args**:
+  - `recurrence` (`string`): An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how
+this window recurs. They go on for the span of time between the start and
+end time. When `null`, the `recurrence` field will be omitted from the resulting object.
+  - `window` (`list[obj]`): Represents an arbitrary window of time. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new](#fn-maintenance_policymaintenance_policywindowwindownew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `recurring_window` sub block.
+
+
+## obj maintenance_policy.window.recurring_window.window
+
+
+
+### fn maintenance_policy.window.recurring_window.window.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new` constructs a new object with attributes and blocks configured for the `window`
+Terraform sub block.
+
+
+
+**Args**:
+  - `end_time` (`string`): The time that the window ends. The end time must take place after the
+start time. When `null`, the `end_time` field will be omitted from the resulting object.
+  - `start_time` (`string`): The time that the window first starts. When `null`, the `start_time` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `window` sub block.
+
+
+## obj networking
+
+
+
+### fn networking.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.networking.new` constructs a new object with attributes and blocks configured for the `networking`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cluster_ipv4_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these
+blocks. Only a single block is supported. This field cannot be changed
+after creation.
+  - `cluster_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all pods in the cluster are
+assigned an IPv6 address from these blocks alongside from an IPv4
+address. Only a single block is supported. This field cannot be changed
+after creation. When `null`, the `cluster_ipv6_cidr_blocks` field will be omitted from the resulting object.
+  - `services_ipv4_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these
+blocks. Only a single block is supported. This field cannot be changed
+after creation.
+  - `services_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all services in the cluster are
+assigned an IPv6 address from these blocks alongside from an IPv4
+address. Only a single block is supported. This field cannot be changed
+after creation. When `null`, the `services_ipv6_cidr_blocks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `networking` sub block.
+
+
+## obj system_addons_config
+
+
+
+### fn system_addons_config.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.system_addons_config.new` constructs a new object with attributes and blocks configured for the `system_addons_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ingress` (`list[obj]`): Config for the Ingress add-on which allows customers to create an Ingress
+object to manage external access to the servers in a cluster. The add-on
+consists of istiod and istio-ingress. When `null`, the `ingress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.ingress.new](#fn-system_addons_configingressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `system_addons_config` sub block.
+
+
+## obj system_addons_config.ingress
+
+
+
+### fn system_addons_config.ingress.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.system_addons_config.ingress.new` constructs a new object with attributes and blocks configured for the `ingress`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disabled` (`bool`): Whether Ingress is disabled. When `null`, the `disabled` field will be omitted from the resulting object.
+  - `ipv4_vip` (`string`): Ingress VIP. When `null`, the `ipv4_vip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ingress` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/edgecontainer_node_pool.md b/docs/4.x/edgecontainer_node_pool.md
new file mode 100644
index 00000000..aaa9116e
--- /dev/null
+++ b/docs/4.x/edgecontainer_node_pool.md
@@ -0,0 +1,435 @@
+---
+permalink: /edgecontainer_node_pool/
+---
+
+# edgecontainer_node_pool
+
+`edgecontainer_node_pool` represents the `google_edgecontainer_node_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCluster()`](#fn-withcluster)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocalDiskEncryption()`](#fn-withlocaldiskencryption)
+* [`fn withLocalDiskEncryptionMixin()`](#fn-withlocaldiskencryptionmixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMachineFilter()`](#fn-withmachinefilter)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withNodeCount()`](#fn-withnodecount)
+* [`fn withNodeLocation()`](#fn-withnodelocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj local_disk_encryption`](#obj-local_disk_encryption)
+  * [`fn new()`](#fn-local_disk_encryptionnew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.new` injects a new `google_edgecontainer_node_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.edgecontainer_node_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.edgecontainer_node_pool` using the reference:
+
+    $._ref.google_edgecontainer_node_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_edgecontainer_node_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.
+The filtering language accepts strings like "name=<name>", and is
+documented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the node pool.
+  - `node_count` (`number`): The number of nodes in the pool.
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: 'us-central1-edge-customer-a'.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.
+  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.edgecontainer_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_node_pool`
+Terraform resource.
+
+Unlike [google.edgecontainer_node_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.
+The filtering language accepts strings like "name=<name>", and is
+documented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the node pool.
+  - `node_count` (`number`): The number of nodes in the pool.
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: 'us-central1-edge-customer-a'.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.
+  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_node_pool` resource into the root Terraform configuration.
+
+
+### fn withCluster
+
+```ts
+withCluster()
+```
+
+`google.string.withCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocalDiskEncryption
+
+```ts
+withLocalDiskEncryption()
+```
+
+`google.list[obj].withLocalDiskEncryption` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the local_disk_encryption field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLocalDiskEncryptionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.
+
+
+### fn withLocalDiskEncryptionMixin
+
+```ts
+withLocalDiskEncryptionMixin()
+```
+
+`google.list[obj].withLocalDiskEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the local_disk_encryption field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLocalDiskEncryption](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMachineFilter
+
+```ts
+withMachineFilter()
+```
+
+`google.string.withMachineFilter` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the machine_filter field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `machine_filter` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeCount
+
+```ts
+withNodeCount()
+```
+
+`google.number.withNodeCount` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the node_count field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `node_count` field.
+
+
+### fn withNodeLocation
+
+```ts
+withNodeLocation()
+```
+
+`google.string.withNodeLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the node_location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `node_location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj local_disk_encryption
+
+
+
+### fn local_disk_encryption.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.local_disk_encryption.new` constructs a new object with attributes and blocks configured for the `local_disk_encryption`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g. projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} to use for protecting node local disks.
+If not specified, a Google-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `local_disk_encryption` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): "The Kubernetes node labels" When `null`, the `labels` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/edgecontainer_vpn_connection.md b/docs/4.x/edgecontainer_vpn_connection.md
new file mode 100644
index 00000000..3a9bdbd8
--- /dev/null
+++ b/docs/4.x/edgecontainer_vpn_connection.md
@@ -0,0 +1,385 @@
+---
+permalink: /edgecontainer_vpn_connection/
+---
+
+# edgecontainer_vpn_connection
+
+`edgecontainer_vpn_connection` represents the `google_edgecontainer_vpn_connection` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCluster()`](#fn-withcluster)
+* [`fn withEnableHighAvailability()`](#fn-withenablehighavailability)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNatGatewayIp()`](#fn-withnatgatewayip)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRouter()`](#fn-withrouter)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVpc()`](#fn-withvpc)
+* [`fn withVpcProject()`](#fn-withvpcproject)
+* [`fn withVpcProjectMixin()`](#fn-withvpcprojectmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj vpc_project`](#obj-vpc_project)
+  * [`fn new()`](#fn-vpc_projectnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_vpn_connection.new` injects a new `google_edgecontainer_vpn_connection` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.edgecontainer_vpn_connection.new('some_id')
+
+You can get the reference to the `id` field of the created `google.edgecontainer_vpn_connection` using the reference:
+
+    $._ref.google_edgecontainer_vpn_connection.some_id.get('id')
+
+This is the same as directly entering `"${ google_edgecontainer_vpn_connection.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.
+  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Google Cloud Platform location.
+  - `name` (`string`): The resource name of VPN connection
+  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.
+This is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.
+  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.edgecontainer_vpn_connection.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_vpn_connection`
+Terraform resource.
+
+Unlike [google.edgecontainer_vpn_connection.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.
+  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Google Cloud Platform location.
+  - `name` (`string`): The resource name of VPN connection
+  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.
+This is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.
+  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_vpn_connection` resource into the root Terraform configuration.
+
+
+### fn withCluster
+
+```ts
+withCluster()
+```
+
+`google.string.withCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster` field.
+
+
+### fn withEnableHighAvailability
+
+```ts
+withEnableHighAvailability()
+```
+
+`google.bool.withEnableHighAvailability` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_high_availability field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_high_availability` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNatGatewayIp
+
+```ts
+withNatGatewayIp()
+```
+
+`google.string.withNatGatewayIp` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the nat_gateway_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `nat_gateway_ip` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRouter
+
+```ts
+withRouter()
+```
+
+`google.string.withRouter` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the router field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `router` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVpc
+
+```ts
+withVpc()
+```
+
+`google.string.withVpc` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the vpc field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `vpc` field.
+
+
+### fn withVpcProject
+
+```ts
+withVpcProject()
+```
+
+`google.list[obj].withVpcProject` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_project field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVpcProjectMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_project` field.
+
+
+### fn withVpcProjectMixin
+
+```ts
+withVpcProjectMixin()
+```
+
+`google.list[obj].withVpcProjectMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_project field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVpcProject](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_project` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_vpn_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj vpc_project
+
+
+
+### fn vpc_project.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_vpn_connection.vpc_project.new` constructs a new object with attributes and blocks configured for the `vpc_project`
+Terraform sub block.
+
+
+
+**Args**:
+  - `project_id` (`string`): The project of the VPC to connect to. If not specified, it is the same as the cluster project. When `null`, the `project_id` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_project` sub block.
diff --git a/docs/4.x/eventarc_trigger.md b/docs/4.x/eventarc_trigger.md
index d54593a1..3305f7d0 100644
--- a/docs/4.x/eventarc_trigger.md
+++ b/docs/4.x/eventarc_trigger.md
@@ -76,7 +76,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.
   - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -110,7 +113,10 @@ injecting into a complete block.
 **Args**:
   - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.
   - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -400,7 +406,6 @@ Terraform sub block.
 
 
 **Args**:
-  - `cloud_function` (`string`): [WARNING] Configuring a Cloud Function in Trigger is not supported as of today. The Cloud Function resource name. Format: projects/{project}/locations/{location}/functions/{function} When `null`, the `cloud_function` field will be omitted from the resulting object.
   - `workflow` (`string`): The resource name of the Workflow whose Executions are triggered by the events. The Workflow resource should be deployed in the same project as the trigger. Format: `projects/{project}/locations/{location}/workflows/{workflow}` When `null`, the `workflow` field will be omitted from the resulting object.
   - `cloud_run_service` (`list[obj]`): Cloud Run fully-managed service that receives the events. The service should be running in the same project of the trigger. When `null`, the `cloud_run_service` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.cloud_run_service.new](#fn-destinationcloud_run_servicenew) constructor.
   - `gke` (`list[obj]`): A GKE service capable of receiving events. The service should be running in the same project as the trigger. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.gke.new](#fn-destinationgkenew) constructor.
diff --git a/docs/4.x/filestore_backup.md b/docs/4.x/filestore_backup.md
index 351392bf..0b203eee 100644
--- a/docs/4.x/filestore_backup.md
+++ b/docs/4.x/filestore_backup.md
@@ -57,7 +57,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.
 
@@ -95,7 +99,11 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.
 
diff --git a/docs/4.x/filestore_instance.md b/docs/4.x/filestore_instance.md
index 2eaf1a46..3b2fb8b4 100644
--- a/docs/4.x/filestore_instance.md
+++ b/docs/4.x/filestore_instance.md
@@ -69,12 +69,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): The resource name of the instance.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `tier` (`string`): The service tier of the instance.
-Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE
+Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL, REGIONAL and ENTERPRISE
   - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.
   - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a
 single file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.
@@ -106,12 +110,16 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): The resource name of the instance.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `tier` (`string`): The service tier of the instance.
-Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE
+Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL, REGIONAL and ENTERPRISE
   - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.
   - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a
 single file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.
@@ -381,6 +389,9 @@ Terraform sub block.
   - `capacity_gb` (`number`): File share capacity in GiB. This must be at least 1024 GiB
 for the standard tier, or 2560 GiB for the premium tier.
   - `name` (`string`): The name of the fileshare (16 characters or less)
+  - `source_backup` (`string`): The resource name of the backup, in the format
+projects/{projectId}/locations/{locationId}/backups/{backupId},
+that this file share has been restored from. When `null`, the `source_backup` field will be omitted from the resulting object.
   - `nfs_export_options` (`list[obj]`): Nfs Export Options. There is a limit of 10 export options per file share. When `null`, the `nfs_export_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.nfs_export_options.new](#fn-file_sharesnfs_export_optionsnew) constructor.
 
 **Returns**:
diff --git a/docs/4.x/filestore_snapshot.md b/docs/4.x/filestore_snapshot.md
index ebf4776f..fbc9eb8a 100644
--- a/docs/4.x/filestore_snapshot.md
+++ b/docs/4.x/filestore_snapshot.md
@@ -57,7 +57,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
   - `instance` (`string`): The resource name of the filestore instance.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.
 
@@ -94,7 +98,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
   - `instance` (`string`): The resource name of the filestore instance.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.
 
diff --git a/docs/4.x/firebaserules_release.md b/docs/4.x/firebaserules_release.md
index 8d5d344a..2e7bedc3 100644
--- a/docs/4.x/firebaserules_release.md
+++ b/docs/4.x/firebaserules_release.md
@@ -191,7 +191,6 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/firestore_backup_schedule.md b/docs/4.x/firestore_backup_schedule.md
new file mode 100644
index 00000000..eacff645
--- /dev/null
+++ b/docs/4.x/firestore_backup_schedule.md
@@ -0,0 +1,332 @@
+---
+permalink: /firestore_backup_schedule/
+---
+
+# firestore_backup_schedule
+
+`firestore_backup_schedule` represents the `google_firestore_backup_schedule` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDailyRecurrence()`](#fn-withdailyrecurrence)
+* [`fn withDailyRecurrenceMixin()`](#fn-withdailyrecurrencemixin)
+* [`fn withDatabase()`](#fn-withdatabase)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRetention()`](#fn-withretention)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withWeeklyRecurrence()`](#fn-withweeklyrecurrence)
+* [`fn withWeeklyRecurrenceMixin()`](#fn-withweeklyrecurrencemixin)
+* [`obj daily_recurrence`](#obj-daily_recurrence)
+  * [`fn new()`](#fn-daily_recurrencenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj weekly_recurrence`](#obj-weekly_recurrence)
+  * [`fn new()`](#fn-weekly_recurrencenew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.new` injects a new `google_firestore_backup_schedule` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.firestore_backup_schedule.new('some_id')
+
+You can get the reference to the `id` field of the created `google.firestore_backup_schedule` using the reference:
+
+    $._ref.google_firestore_backup_schedule.some_id.get('id')
+
+This is the same as directly entering `"${ google_firestore_backup_schedule.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.
+A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+
+For a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.
+  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.
+  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.firestore_backup_schedule.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_backup_schedule`
+Terraform resource.
+
+Unlike [google.firestore_backup_schedule.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.
+A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+
+For a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.
+  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.
+  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_backup_schedule` resource into the root Terraform configuration.
+
+
+### fn withDailyRecurrence
+
+```ts
+withDailyRecurrence()
+```
+
+`google.list[obj].withDailyRecurrence` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the daily_recurrence field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDailyRecurrenceMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.
+
+
+### fn withDailyRecurrenceMixin
+
+```ts
+withDailyRecurrenceMixin()
+```
+
+`google.list[obj].withDailyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the daily_recurrence field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDailyRecurrence](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.
+
+
+### fn withDatabase
+
+```ts
+withDatabase()
+```
+
+`google.string.withDatabase` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the database field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `database` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRetention
+
+```ts
+withRetention()
+```
+
+`google.string.withRetention` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the retention field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `retention` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withWeeklyRecurrence
+
+```ts
+withWeeklyRecurrence()
+```
+
+`google.list[obj].withWeeklyRecurrence` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the weekly_recurrence field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withWeeklyRecurrenceMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.
+
+
+### fn withWeeklyRecurrenceMixin
+
+```ts
+withWeeklyRecurrenceMixin()
+```
+
+`google.list[obj].withWeeklyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the weekly_recurrence field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withWeeklyRecurrence](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.
+
+
+## obj daily_recurrence
+
+
+
+### fn daily_recurrence.new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.daily_recurrence.new` constructs a new object with attributes and blocks configured for the `daily_recurrence`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `daily_recurrence` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj weekly_recurrence
+
+
+
+### fn weekly_recurrence.new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.weekly_recurrence.new` constructs a new object with attributes and blocks configured for the `weekly_recurrence`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`string`): The day of week to run. Possible values: ["DAY_OF_WEEK_UNSPECIFIED", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `weekly_recurrence` sub block.
diff --git a/docs/4.x/firestore_database.md b/docs/4.x/firestore_database.md
index d3236b3a..fde0657c 100644
--- a/docs/4.x/firestore_database.md
+++ b/docs/4.x/firestore_database.md
@@ -18,6 +18,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withAppEngineIntegrationMode()`](#fn-withappengineintegrationmode)
 * [`fn withConcurrencyMode()`](#fn-withconcurrencymode)
 * [`fn withDeleteProtectionState()`](#fn-withdeleteprotectionstate)
+* [`fn withDeletionPolicy()`](#fn-withdeletionpolicy)
 * [`fn withLocationId()`](#fn-withlocationid)
 * [`fn withName()`](#fn-withname)
 * [`fn withPointInTimeRecoveryEnablement()`](#fn-withpointintimerecoveryenablement)
@@ -59,7 +60,15 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `app_engine_integration_mode` (`string`): The App Engine integration mode to use for this database. Possible values: ["ENABLED", "DISABLED"] When `null`, the `app_engine_integration_mode` field will be omitted from the resulting object.
   - `concurrency_mode` (`string`): The concurrency control mode to use for this database. Possible values: ["OPTIMISTIC", "PESSIMISTIC", "OPTIMISTIC_WITH_ENTITY_GROUPS"] When `null`, the `concurrency_mode` field will be omitted from the resulting object.
-  - `delete_protection_state` (`string`): State of delete protection for the database. Possible values: ["DELETE_PROTECTION_STATE_UNSPECIFIED", "DELETE_PROTECTION_ENABLED", "DELETE_PROTECTION_DISABLED"] When `null`, the `delete_protection_state` field will be omitted from the resulting object.
+  - `delete_protection_state` (`string`): State of delete protection for the database.
+When delete protection is enabled, this database cannot be deleted.
+The default value is 'DELETE_PROTECTION_STATE_UNSPECIFIED', which is currently equivalent to 'DELETE_PROTECTION_DISABLED'.
+**Note:** Additionally, to delete this database using 'terraform destroy', 'deletion_policy' must be set to 'DELETE'. Possible values: ["DELETE_PROTECTION_STATE_UNSPECIFIED", "DELETE_PROTECTION_ENABLED", "DELETE_PROTECTION_DISABLED"] When `null`, the `delete_protection_state` field will be omitted from the resulting object.
+  - `deletion_policy` (`string`): Deletion behavior for this database.
+If the deletion policy is 'ABANDON', the database will be removed from Terraform state but not deleted from Google Cloud upon destruction.
+If the deletion policy is 'DELETE', the database will both be removed from Terraform state and deleted from Google Cloud upon destruction.
+The default value is 'ABANDON'.
+See also 'delete_protection'. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `location_id` (`string`): The location of the database. Available locations are listed at
 https://cloud.google.com/firestore/docs/locations.
   - `name` (`string`): The ID to use for the database, which will become the final
@@ -103,7 +112,15 @@ injecting into a complete block.
 **Args**:
   - `app_engine_integration_mode` (`string`): The App Engine integration mode to use for this database. Possible values: ["ENABLED", "DISABLED"] When `null`, the `app_engine_integration_mode` field will be omitted from the resulting object.
   - `concurrency_mode` (`string`): The concurrency control mode to use for this database. Possible values: ["OPTIMISTIC", "PESSIMISTIC", "OPTIMISTIC_WITH_ENTITY_GROUPS"] When `null`, the `concurrency_mode` field will be omitted from the resulting object.
-  - `delete_protection_state` (`string`): State of delete protection for the database. Possible values: ["DELETE_PROTECTION_STATE_UNSPECIFIED", "DELETE_PROTECTION_ENABLED", "DELETE_PROTECTION_DISABLED"] When `null`, the `delete_protection_state` field will be omitted from the resulting object.
+  - `delete_protection_state` (`string`): State of delete protection for the database.
+When delete protection is enabled, this database cannot be deleted.
+The default value is 'DELETE_PROTECTION_STATE_UNSPECIFIED', which is currently equivalent to 'DELETE_PROTECTION_DISABLED'.
+**Note:** Additionally, to delete this database using 'terraform destroy', 'deletion_policy' must be set to 'DELETE'. Possible values: ["DELETE_PROTECTION_STATE_UNSPECIFIED", "DELETE_PROTECTION_ENABLED", "DELETE_PROTECTION_DISABLED"] When `null`, the `delete_protection_state` field will be omitted from the resulting object.
+  - `deletion_policy` (`string`): Deletion behavior for this database.
+If the deletion policy is 'ABANDON', the database will be removed from Terraform state but not deleted from Google Cloud upon destruction.
+If the deletion policy is 'DELETE', the database will both be removed from Terraform state and deleted from Google Cloud upon destruction.
+The default value is 'ABANDON'.
+See also 'delete_protection'. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `location_id` (`string`): The location of the database. Available locations are listed at
 https://cloud.google.com/firestore/docs/locations.
   - `name` (`string`): The ID to use for the database, which will become the final
@@ -175,6 +192,22 @@ Terraform resource block to set or update the delete_protection_state field.
   - `value` (`string`): The value to set for the `delete_protection_state` field.
 
 
+### fn withDeletionPolicy
+
+```ts
+withDeletionPolicy()
+```
+
+`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the deletion_policy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `deletion_policy` field.
+
+
 ### fn withLocationId
 
 ```ts
diff --git a/docs/4.x/firestore_field.md b/docs/4.x/firestore_field.md
index 8698adb3..a900a787 100644
--- a/docs/4.x/firestore_field.md
+++ b/docs/4.x/firestore_field.md
@@ -72,7 +72,7 @@ Creating an index configuration for this field will override any inherited confi
 indexes specified. Configuring the index configuration with an empty block disables all indexes on
 the field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.
-  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
+  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. 'ttl_config {}'), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -105,7 +105,7 @@ Creating an index configuration for this field will override any inherited confi
 indexes specified. Configuring the index configuration with an empty block disables all indexes on
 the field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.
-  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
+  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. 'ttl_config {}'), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_field` resource into the root Terraform configuration.
diff --git a/docs/4.x/firestore_index.md b/docs/4.x/firestore_index.md
index 784a4120..9a52b295 100644
--- a/docs/4.x/firestore_index.md
+++ b/docs/4.x/firestore_index.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withApiScope()`](#fn-withapiscope)
 * [`fn withCollection()`](#fn-withcollection)
 * [`fn withDatabase()`](#fn-withdatabase)
 * [`fn withFields()`](#fn-withfields)
@@ -57,10 +58,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `api_scope` (`string`): The API scope at which a query is run. Default value: "ANY_API" Possible values: ["ANY_API", "DATASTORE_MODE_API"] When `null`, the `api_scope` field will be omitted from the resulting object.
   - `collection` (`string`): The collection being indexed.
   - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP"] When `null`, the `query_scope` field will be omitted from the resulting object.
+  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP", "COLLECTION_RECURSIVE"] When `null`, the `query_scope` field will be omitted from the resulting object.
   - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for
 the field path '__name__'. If, on creation, '__name__' was not
 specified as the last field, it will be added automatically with the
@@ -91,10 +93,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `api_scope` (`string`): The API scope at which a query is run. Default value: "ANY_API" Possible values: ["ANY_API", "DATASTORE_MODE_API"] When `null`, the `api_scope` field will be omitted from the resulting object.
   - `collection` (`string`): The collection being indexed.
   - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP"] When `null`, the `query_scope` field will be omitted from the resulting object.
+  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP", "COLLECTION_RECURSIVE"] When `null`, the `query_scope` field will be omitted from the resulting object.
   - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for
 the field path '__name__'. If, on creation, '__name__' was not
 specified as the last field, it will be added automatically with the
@@ -107,6 +110,22 @@ ordered '"ASCENDING"' (unless explicitly specified otherwise). W
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_index` resource into the root Terraform configuration.
 
 
+### fn withApiScope
+
+```ts
+withApiScope()
+```
+
+`google.string.withApiScope` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the api_scope field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `api_scope` field.
+
+
 ### fn withCollection
 
 ```ts
diff --git a/docs/4.x/game_services_game_server_cluster.md b/docs/4.x/game_services_game_server_cluster.md
deleted file mode 100644
index d11c09f2..00000000
--- a/docs/4.x/game_services_game_server_cluster.md
+++ /dev/null
@@ -1,361 +0,0 @@
----
-permalink: /game_services_game_server_cluster/
----
-
-# game_services_game_server_cluster
-
-`game_services_game_server_cluster` represents the `google_game_services_game_server_cluster` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withClusterId()`](#fn-withclusterid)
-* [`fn withConnectionInfo()`](#fn-withconnectioninfo)
-* [`fn withConnectionInfoMixin()`](#fn-withconnectioninfomixin)
-* [`fn withDescription()`](#fn-withdescription)
-* [`fn withLabels()`](#fn-withlabels)
-* [`fn withLocation()`](#fn-withlocation)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withRealmId()`](#fn-withrealmid)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj connection_info`](#obj-connection_info)
-  * [`fn new()`](#fn-connection_infonew)
-  * [`obj connection_info.gke_cluster_reference`](#obj-connection_infogke_cluster_reference)
-    * [`fn new()`](#fn-connection_infogke_cluster_referencenew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.new` injects a new `google_game_services_game_server_cluster` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_game_server_cluster.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_game_server_cluster` using the reference:
-
-    $._ref.google_game_services_game_server_cluster.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_game_server_cluster.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `cluster_id` (`string`): Required. The resource name of the game server cluster
-  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): The realm id of the game server realm.
-  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to
-manage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_game_server_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_cluster`
-Terraform resource.
-
-Unlike [google.game_services_game_server_cluster.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `cluster_id` (`string`): Required. The resource name of the game server cluster
-  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): The realm id of the game server realm.
-  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to
-manage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_cluster` resource into the root Terraform configuration.
-
-
-### fn withClusterId
-
-```ts
-withClusterId()
-```
-
-`google.string.withClusterId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the cluster_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `cluster_id` field.
-
-
-### fn withConnectionInfo
-
-```ts
-withConnectionInfo()
-```
-
-`google.list[obj].withConnectionInfo` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the connection_info field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withConnectionInfoMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `connection_info` field.
-
-
-### fn withConnectionInfoMixin
-
-```ts
-withConnectionInfoMixin()
-```
-
-`google.list[obj].withConnectionInfoMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the connection_info field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withConnectionInfo](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `connection_info` field.
-
-
-### fn withDescription
-
-```ts
-withDescription()
-```
-
-`google.string.withDescription` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the description field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `description` field.
-
-
-### fn withLabels
-
-```ts
-withLabels()
-```
-
-`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the labels field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `labels` field.
-
-
-### fn withLocation
-
-```ts
-withLocation()
-```
-
-`google.string.withLocation` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the location field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `location` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRealmId
-
-```ts
-withRealmId()
-```
-
-`google.string.withRealmId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the realm_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `realm_id` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj connection_info
-
-
-
-### fn connection_info.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.connection_info.new` constructs a new object with attributes and blocks configured for the `connection_info`
-Terraform sub block.
-
-
-
-**Args**:
-  - `namespace` (`string`): Namespace designated on the game server cluster where the game server
-instances will be created. The namespace existence will be validated
-during creation.
-  - `gke_cluster_reference` (`list[obj]`): Reference of the GKE cluster where the game servers are installed. When `null`, the `gke_cluster_reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new](#fn-connection_infogke_cluster_referencenew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `connection_info` sub block.
-
-
-## obj connection_info.gke_cluster_reference
-
-
-
-### fn connection_info.gke_cluster_reference.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new` constructs a new object with attributes and blocks configured for the `gke_cluster_reference`
-Terraform sub block.
-
-
-
-**Args**:
-  - `cluster` (`string`): The full or partial name of a GKE cluster, using one of the following
-forms:
-
-* 'projects/{project_id}/locations/{location}/clusters/{cluster_id}'
-* 'locations/{location}/clusters/{cluster_id}'
-* '{cluster_id}'
-
-If project and location are not specified, the project and location of the
-GameServerCluster resource are used to generate the full name of the
-GKE cluster.
-
-**Returns**:
-  - An attribute object that represents the `gke_cluster_reference` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_game_server_config.md b/docs/4.x/game_services_game_server_config.md
deleted file mode 100644
index 4c69a354..00000000
--- a/docs/4.x/game_services_game_server_config.md
+++ /dev/null
@@ -1,467 +0,0 @@
----
-permalink: /game_services_game_server_config/
----
-
-# game_services_game_server_config
-
-`game_services_game_server_config` represents the `google_game_services_game_server_config` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withConfigId()`](#fn-withconfigid)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-* [`fn withDescription()`](#fn-withdescription)
-* [`fn withFleetConfigs()`](#fn-withfleetconfigs)
-* [`fn withFleetConfigsMixin()`](#fn-withfleetconfigsmixin)
-* [`fn withLabels()`](#fn-withlabels)
-* [`fn withLocation()`](#fn-withlocation)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withScalingConfigs()`](#fn-withscalingconfigs)
-* [`fn withScalingConfigsMixin()`](#fn-withscalingconfigsmixin)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj fleet_configs`](#obj-fleet_configs)
-  * [`fn new()`](#fn-fleet_configsnew)
-* [`obj scaling_configs`](#obj-scaling_configs)
-  * [`fn new()`](#fn-scaling_configsnew)
-  * [`obj scaling_configs.schedules`](#obj-scaling_configsschedules)
-    * [`fn new()`](#fn-scaling_configsschedulesnew)
-  * [`obj scaling_configs.selectors`](#obj-scaling_configsselectors)
-    * [`fn new()`](#fn-scaling_configsselectorsnew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.new` injects a new `google_game_services_game_server_config` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_game_server_config.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_game_server_config` using the reference:
-
-    $._ref.google_game_services_game_server_config.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_game_server_config.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `config_id` (`string`): A unique id for the deployment config.
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server config. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there
-will be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.
-  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_game_server_config.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_config`
-Terraform resource.
-
-Unlike [google.game_services_game_server_config.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `config_id` (`string`): A unique id for the deployment config.
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server config. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there
-will be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.
-  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_config` resource into the root Terraform configuration.
-
-
-### fn withConfigId
-
-```ts
-withConfigId()
-```
-
-`google.string.withConfigId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the config_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `config_id` field.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the deployment_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
-
-
-### fn withDescription
-
-```ts
-withDescription()
-```
-
-`google.string.withDescription` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the description field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `description` field.
-
-
-### fn withFleetConfigs
-
-```ts
-withFleetConfigs()
-```
-
-`google.list[obj].withFleetConfigs` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the fleet_configs field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withFleetConfigsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.
-
-
-### fn withFleetConfigsMixin
-
-```ts
-withFleetConfigsMixin()
-```
-
-`google.list[obj].withFleetConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the fleet_configs field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withFleetConfigs](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.
-
-
-### fn withLabels
-
-```ts
-withLabels()
-```
-
-`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the labels field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `labels` field.
-
-
-### fn withLocation
-
-```ts
-withLocation()
-```
-
-`google.string.withLocation` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the location field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `location` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withScalingConfigs
-
-```ts
-withScalingConfigs()
-```
-
-`google.list[obj].withScalingConfigs` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the scaling_configs field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withScalingConfigsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.
-
-
-### fn withScalingConfigsMixin
-
-```ts
-withScalingConfigsMixin()
-```
-
-`google.list[obj].withScalingConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the scaling_configs field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withScalingConfigs](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj fleet_configs
-
-
-
-### fn fleet_configs.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.fleet_configs.new` constructs a new object with attributes and blocks configured for the `fleet_configs`
-Terraform sub block.
-
-
-
-**Args**:
-  - `fleet_spec` (`string`): The fleet spec, which is sent to Agones to configure fleet.
-The spec can be passed as inline json but it is recommended to use a file reference
-instead. File references can contain the json or yaml format of the fleet spec. Eg:
-
-* fleet_spec = jsonencode(yamldecode(file("fleet_configs.yaml")))
-* fleet_spec = file("fleet_configs.json")
-
-The format of the spec can be found :
-'https://agones.dev/site/docs/reference/fleet/'.
-  - `name` (`string`): The name of the FleetConfig. When `null`, the `name` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `fleet_configs` sub block.
-
-
-## obj scaling_configs
-
-
-
-### fn scaling_configs.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.scaling_configs.new` constructs a new object with attributes and blocks configured for the `scaling_configs`
-Terraform sub block.
-
-
-
-**Args**:
-  - `fleet_autoscaler_spec` (`string`): Fleet autoscaler spec, which is sent to Agones.
-Example spec can be found :
-https://agones.dev/site/docs/reference/fleetautoscaler/
-  - `name` (`string`): The name of the ScalingConfig
-  - `schedules` (`list[obj]`): The schedules to which this scaling config applies. When `null`, the `schedules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.schedules.new](#fn-scaling_configsschedulesnew) constructor.
-  - `selectors` (`list[obj]`): Labels used to identify the clusters to which this scaling config
-applies. A cluster is subject to this scaling config if its labels match
-any of the selector entries. When `null`, the `selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.selectors.new](#fn-scaling_configsselectorsnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `scaling_configs` sub block.
-
-
-## obj scaling_configs.schedules
-
-
-
-### fn scaling_configs.schedules.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.scaling_configs.schedules.new` constructs a new object with attributes and blocks configured for the `schedules`
-Terraform sub block.
-
-
-
-**Args**:
-  - `cron_job_duration` (`string`): The duration for the cron job event. The duration of the event is effective
-after the cron job's start time.
-
-A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `cron_job_duration` field will be omitted from the resulting object.
-  - `cron_spec` (`string`): The cron definition of the scheduled event. See
-https://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as
-defined by the realm. When `null`, the `cron_spec` field will be omitted from the resulting object.
-  - `end_time` (`string`): The end time of the event.
-
-A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `end_time` field will be omitted from the resulting object.
-  - `start_time` (`string`): The start time of the event.
-
-A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `start_time` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `schedules` sub block.
-
-
-## obj scaling_configs.selectors
-
-
-
-### fn scaling_configs.selectors.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.scaling_configs.selectors.new` constructs a new object with attributes and blocks configured for the `selectors`
-Terraform sub block.
-
-
-
-**Args**:
-  - `labels` (`obj`): Set of labels to group by. When `null`, the `labels` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `selectors` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_game_server_deployment_rollout.md b/docs/4.x/game_services_game_server_deployment_rollout.md
deleted file mode 100644
index 6a01c4a3..00000000
--- a/docs/4.x/game_services_game_server_deployment_rollout.md
+++ /dev/null
@@ -1,301 +0,0 @@
----
-permalink: /game_services_game_server_deployment_rollout/
----
-
-# game_services_game_server_deployment_rollout
-
-`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDefaultGameServerConfig()`](#fn-withdefaultgameserverconfig)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-* [`fn withGameServerConfigOverrides()`](#fn-withgameserverconfigoverrides)
-* [`fn withGameServerConfigOverridesMixin()`](#fn-withgameserverconfigoverridesmixin)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj game_server_config_overrides`](#obj-game_server_config_overrides)
-  * [`fn new()`](#fn-game_server_config_overridesnew)
-  * [`obj game_server_config_overrides.realms_selector`](#obj-game_server_config_overridesrealms_selector)
-    * [`fn new()`](#fn-game_server_config_overridesrealms_selectornew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.new` injects a new `google_game_services_game_server_deployment_rollout` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_game_server_deployment_rollout.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_game_server_deployment_rollout` using the reference:
-
-    $._ref.google_game_services_game_server_deployment_rollout.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_game_server_deployment_rollout.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `default_game_server_config` (`string`): This field points to the game server config that is
-applied by default to all realms and clusters. For example,
-
-'projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config'.
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config
-overrides. The overrides are processed in the order they are listed. As
-soon as a match is found for a cluster, the rest of the list is not
-processed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`
-Terraform resource.
-
-Unlike [google.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `default_game_server_config` (`string`): This field points to the game server config that is
-applied by default to all realms and clusters. For example,
-
-'projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config'.
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config
-overrides. The overrides are processed in the order they are listed. As
-soon as a match is found for a cluster, the rest of the list is not
-processed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment_rollout` resource into the root Terraform configuration.
-
-
-### fn withDefaultGameServerConfig
-
-```ts
-withDefaultGameServerConfig()
-```
-
-`google.string.withDefaultGameServerConfig` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the default_game_server_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `default_game_server_config` field.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the deployment_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
-
-
-### fn withGameServerConfigOverrides
-
-```ts
-withGameServerConfigOverrides()
-```
-
-`google.list[obj].withGameServerConfigOverrides` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the game_server_config_overrides field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withGameServerConfigOverridesMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.
-
-
-### fn withGameServerConfigOverridesMixin
-
-```ts
-withGameServerConfigOverridesMixin()
-```
-
-`google.list[obj].withGameServerConfigOverridesMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the game_server_config_overrides field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withGameServerConfigOverrides](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj game_server_config_overrides
-
-
-
-### fn game_server_config_overrides.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.game_server_config_overrides.new` constructs a new object with attributes and blocks configured for the `game_server_config_overrides`
-Terraform sub block.
-
-
-
-**Args**:
-  - `config_version` (`string`): Version of the configuration. When `null`, the `config_version` field will be omitted from the resulting object.
-  - `realms_selector` (`list[obj]`): Selection by realms. When `null`, the `realms_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new](#fn-game_server_config_overridesrealms_selectornew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `game_server_config_overrides` sub block.
-
-
-## obj game_server_config_overrides.realms_selector
-
-
-
-### fn game_server_config_overrides.realms_selector.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new` constructs a new object with attributes and blocks configured for the `realms_selector`
-Terraform sub block.
-
-
-
-**Args**:
-  - `realms` (`list`): List of realms to match against. When `null`, the `realms` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `realms_selector` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gke_backup_backup_plan.md b/docs/4.x/gke_backup_backup_plan.md
index 0e2badb1..34f850a8 100644
--- a/docs/4.x/gke_backup_backup_plan.md
+++ b/docs/4.x/gke_backup_backup_plan.md
@@ -84,7 +84,11 @@ from being created via this BackupPlan (including scheduled Backups). When `null
   - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Backup Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -123,7 +127,11 @@ from being created via this BackupPlan (including scheduled Backups). When `null
   - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Backup Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/gke_backup_restore_plan.md b/docs/4.x/gke_backup_restore_plan.md
index 80509709..6df531fb 100644
--- a/docs/4.x/gke_backup_restore_plan.md
+++ b/docs/4.x/gke_backup_restore_plan.md
@@ -88,7 +88,11 @@ as the source for Restores created via this RestorePlan.
   - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Restore Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -123,7 +127,11 @@ as the source for Restores created via this RestorePlan.
   - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Restore Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/gke_hub_feature.md b/docs/4.x/gke_hub_feature.md
index e8d95faa..e0959b4f 100644
--- a/docs/4.x/gke_hub_feature.md
+++ b/docs/4.x/gke_hub_feature.md
@@ -15,6 +15,8 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withFleetDefaultMemberConfig()`](#fn-withfleetdefaultmemberconfig)
+* [`fn withFleetDefaultMemberConfigMixin()`](#fn-withfleetdefaultmemberconfigmixin)
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
@@ -23,8 +25,52 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withSpecMixin()`](#fn-withspecmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj fleet_default_member_config`](#obj-fleet_default_member_config)
+  * [`fn new()`](#fn-fleet_default_member_confignew)
+  * [`obj fleet_default_member_config.configmanagement`](#obj-fleet_default_member_configconfigmanagement)
+    * [`fn new()`](#fn-fleet_default_member_configconfigmanagementnew)
+    * [`obj fleet_default_member_config.configmanagement.config_sync`](#obj-fleet_default_member_configconfigmanagementconfig_sync)
+      * [`fn new()`](#fn-fleet_default_member_configconfigmanagementconfig_syncnew)
+      * [`obj fleet_default_member_config.configmanagement.config_sync.git`](#obj-fleet_default_member_configconfigmanagementconfig_syncgit)
+        * [`fn new()`](#fn-fleet_default_member_configconfigmanagementconfig_syncgitnew)
+      * [`obj fleet_default_member_config.configmanagement.config_sync.oci`](#obj-fleet_default_member_configconfigmanagementconfig_syncoci)
+        * [`fn new()`](#fn-fleet_default_member_configconfigmanagementconfig_syncocinew)
+  * [`obj fleet_default_member_config.mesh`](#obj-fleet_default_member_configmesh)
+    * [`fn new()`](#fn-fleet_default_member_configmeshnew)
+  * [`obj fleet_default_member_config.policycontroller`](#obj-fleet_default_member_configpolicycontroller)
+    * [`fn new()`](#fn-fleet_default_member_configpolicycontrollernew)
+    * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_config)
+      * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_confignew)
+      * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configs)
+        * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configsnew)
+        * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configscontainer_resources)
+          * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configscontainer_resourcesnew)
+          * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configscontainer_resourceslimits)
+            * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configscontainer_resourceslimitsnew)
+          * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configscontainer_resourcesrequests)
+            * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configscontainer_resourcesrequestsnew)
+        * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configspod_toleration)
+          * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configspod_tolerationnew)
+      * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configmonitoring)
+        * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configmonitoringnew)
+      * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configpolicy_content)
+        * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configpolicy_contentnew)
+        * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configpolicy_contentbundles)
+          * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configpolicy_contentbundlesnew)
+        * [`obj fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library`](#obj-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configpolicy_contenttemplate_library)
+          * [`fn new()`](#fn-fleet_default_member_configpolicycontrollerpolicy_controller_hub_configpolicy_contenttemplate_librarynew)
 * [`obj spec`](#obj-spec)
   * [`fn new()`](#fn-specnew)
+  * [`obj spec.clusterupgrade`](#obj-specclusterupgrade)
+    * [`fn new()`](#fn-specclusterupgradenew)
+    * [`obj spec.clusterupgrade.gke_upgrade_overrides`](#obj-specclusterupgradegke_upgrade_overrides)
+      * [`fn new()`](#fn-specclusterupgradegke_upgrade_overridesnew)
+      * [`obj spec.clusterupgrade.gke_upgrade_overrides.post_conditions`](#obj-specclusterupgradegke_upgrade_overridespost_conditions)
+        * [`fn new()`](#fn-specclusterupgradegke_upgrade_overridespost_conditionsnew)
+      * [`obj spec.clusterupgrade.gke_upgrade_overrides.upgrade`](#obj-specclusterupgradegke_upgrade_overridesupgrade)
+        * [`fn new()`](#fn-specclusterupgradegke_upgrade_overridesupgradenew)
+    * [`obj spec.clusterupgrade.post_conditions`](#obj-specclusterupgradepost_conditions)
+      * [`fn new()`](#fn-specclusterupgradepost_conditionsnew)
   * [`obj spec.fleetobservability`](#obj-specfleetobservability)
     * [`fn new()`](#fn-specfleetobservabilitynew)
     * [`obj spec.fleetobservability.logging_config`](#obj-specfleetobservabilitylogging_config)
@@ -67,10 +113,14 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): GCP labels for this Feature.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `fleet_default_member_config` (`list[obj]`): Optional. Fleet Default Membership Configuration. When `null`, the `fleet_default_member_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.new](#fn-fleet_default_member_confignew) constructor.
   - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -96,10 +146,14 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): GCP labels for this Feature.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `fleet_default_member_config` (`list[obj]`): Optional. Fleet Default Membership Configuration. When `null`, the `fleet_default_member_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.new](#fn-fleet_default_member_confignew) constructor.
   - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -107,6 +161,43 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature` resource into the root Terraform configuration.
 
 
+### fn withFleetDefaultMemberConfig
+
+```ts
+withFleetDefaultMemberConfig()
+```
+
+`google.list[obj].withFleetDefaultMemberConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet_default_member_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withFleetDefaultMemberConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet_default_member_config` field.
+
+
+### fn withFleetDefaultMemberConfigMixin
+
+```ts
+withFleetDefaultMemberConfigMixin()
+```
+
+`google.list[obj].withFleetDefaultMemberConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet_default_member_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withFleetDefaultMemberConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet_default_member_config` field.
+
+
 ### fn withLabels
 
 ```ts
@@ -244,6 +335,436 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj fleet_default_member_config
+
+
+
+### fn fleet_default_member_config.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.new` constructs a new object with attributes and blocks configured for the `fleet_default_member_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `configmanagement` (`list[obj]`): Config Management spec When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.new](#fn-fleet_default_member_configconfigmanagementnew) constructor.
+  - `mesh` (`list[obj]`): Service Mesh spec When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.mesh.new](#fn-fleet_default_member_configmeshnew) constructor.
+  - `policycontroller` (`list[obj]`): Policy Controller spec When `null`, the `policycontroller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.new](#fn-fleet_default_member_configpolicycontrollernew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `fleet_default_member_config` sub block.
+
+
+## obj fleet_default_member_config.configmanagement
+
+
+
+### fn fleet_default_member_config.configmanagement.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.configmanagement.new` constructs a new object with attributes and blocks configured for the `configmanagement`
+Terraform sub block.
+
+
+
+**Args**:
+  - `version` (`string`): Version of ACM installed When `null`, the `version` field will be omitted from the resulting object.
+  - `config_sync` (`list[obj]`): ConfigSync configuration for the cluster When `null`, the `config_sync` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.new](#fn-fleet_default_member_configfleet_default_member_configconfig_syncnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `configmanagement` sub block.
+
+
+## obj fleet_default_member_config.configmanagement.config_sync
+
+
+
+### fn fleet_default_member_config.configmanagement.config_sync.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.new` constructs a new object with attributes and blocks configured for the `config_sync`
+Terraform sub block.
+
+
+
+**Args**:
+  - `source_format` (`string`): Specifies whether the Config Sync Repo is in hierarchical or unstructured mode When `null`, the `source_format` field will be omitted from the resulting object.
+  - `git` (`list[obj]`): Git repo configuration for the cluster When `null`, the `git` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.git.new](#fn-fleet_default_member_configfleet_default_member_configconfigmanagementgitnew) constructor.
+  - `oci` (`list[obj]`): OCI repo configuration for the cluster When `null`, the `oci` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.oci.new](#fn-fleet_default_member_configfleet_default_member_configconfigmanagementocinew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `config_sync` sub block.
+
+
+## obj fleet_default_member_config.configmanagement.config_sync.git
+
+
+
+### fn fleet_default_member_config.configmanagement.config_sync.git.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.git.new` constructs a new object with attributes and blocks configured for the `git`
+Terraform sub block.
+
+
+
+**Args**:
+  - `gcp_service_account_email` (`string`): The Google Cloud Service Account Email used for auth when secretType is gcpServiceAccount When `null`, the `gcp_service_account_email` field will be omitted from the resulting object.
+  - `https_proxy` (`string`): URL for the HTTPS Proxy to be used when communicating with the Git repo When `null`, the `https_proxy` field will be omitted from the resulting object.
+  - `policy_dir` (`string`): The path within the Git repository that represents the top level of the repo to sync When `null`, the `policy_dir` field will be omitted from the resulting object.
+  - `secret_type` (`string`): Type of secret configured for access to the Git repo
+  - `sync_branch` (`string`): The branch of the repository to sync from. Default: master When `null`, the `sync_branch` field will be omitted from the resulting object.
+  - `sync_repo` (`string`): The URL of the Git repository to use as the source of truth When `null`, the `sync_repo` field will be omitted from the resulting object.
+  - `sync_rev` (`string`): Git revision (tag or hash) to check out. Default HEAD When `null`, the `sync_rev` field will be omitted from the resulting object.
+  - `sync_wait_secs` (`string`): Period in seconds between consecutive syncs. Default: 15 When `null`, the `sync_wait_secs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `git` sub block.
+
+
+## obj fleet_default_member_config.configmanagement.config_sync.oci
+
+
+
+### fn fleet_default_member_config.configmanagement.config_sync.oci.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.configmanagement.config_sync.oci.new` constructs a new object with attributes and blocks configured for the `oci`
+Terraform sub block.
+
+
+
+**Args**:
+  - `gcp_service_account_email` (`string`): The Google Cloud Service Account Email used for auth when secretType is gcpServiceAccount When `null`, the `gcp_service_account_email` field will be omitted from the resulting object.
+  - `policy_dir` (`string`): The absolute path of the directory that contains the local resources. Default: the root directory of the image When `null`, the `policy_dir` field will be omitted from the resulting object.
+  - `secret_type` (`string`): Type of secret configured for access to the Git repo
+  - `sync_repo` (`string`): The OCI image repository URL for the package to sync from When `null`, the `sync_repo` field will be omitted from the resulting object.
+  - `sync_wait_secs` (`string`): Period in seconds between consecutive syncs. Default: 15 When `null`, the `sync_wait_secs` field will be omitted from the resulting object.
+  - `version` (`string`): Version of ACM installed When `null`, the `version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `oci` sub block.
+
+
+## obj fleet_default_member_config.mesh
+
+
+
+### fn fleet_default_member_config.mesh.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.mesh.new` constructs a new object with attributes and blocks configured for the `mesh`
+Terraform sub block.
+
+
+
+**Args**:
+  - `management` (`string`): Whether to automatically manage Service Mesh Possible values: ["MANAGEMENT_UNSPECIFIED", "MANAGEMENT_AUTOMATIC", "MANAGEMENT_MANUAL"]
+
+**Returns**:
+  - An attribute object that represents the `mesh` sub block.
+
+
+## obj fleet_default_member_config.policycontroller
+
+
+
+### fn fleet_default_member_config.policycontroller.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.new` constructs a new object with attributes and blocks configured for the `policycontroller`
+Terraform sub block.
+
+
+
+**Args**:
+  - `version` (`string`): Configures the version of Policy Controller When `null`, the `version` field will be omitted from the resulting object.
+  - `policy_controller_hub_config` (`list[obj]`): Configuration of Policy Controller When `null`, the `policy_controller_hub_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.new](#fn-fleet_default_member_configfleet_default_member_configpolicy_controller_hub_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policycontroller` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.new` constructs a new object with attributes and blocks configured for the `policy_controller_hub_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audit_interval_seconds` (`number`): Interval for Policy Controller Audit scans (in seconds). When set to 0, this disables audit functionality altogether. When `null`, the `audit_interval_seconds` field will be omitted from the resulting object.
+  - `constraint_violation_limit` (`number`): The maximum number of audit violations to be stored in a constraint. If not set, the internal default of 20 will be used. When `null`, the `constraint_violation_limit` field will be omitted from the resulting object.
+  - `exemptable_namespaces` (`list`): The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. When `null`, the `exemptable_namespaces` field will be omitted from the resulting object.
+  - `install_spec` (`string`): Configures the mode of the Policy Controller installation Possible values: ["INSTALL_SPEC_UNSPECIFIED", "INSTALL_SPEC_NOT_INSTALLED", "INSTALL_SPEC_ENABLED", "INSTALL_SPEC_SUSPENDED", "INSTALL_SPEC_DETACHED"]
+  - `log_denies_enabled` (`bool`): Logs all denies and dry run failures. When `null`, the `log_denies_enabled` field will be omitted from the resulting object.
+  - `mutation_enabled` (`bool`): Enables the ability to mutate resources using Policy Controller. When `null`, the `mutation_enabled` field will be omitted from the resulting object.
+  - `referential_rules_enabled` (`bool`): Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. When `null`, the `referential_rules_enabled` field will be omitted from the resulting object.
+  - `deployment_configs` (`list[obj]`): Map of deployment configs to deployments ("admission", "audit", "mutation"). When `null`, the `deployment_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerdeployment_configsnew) constructor.
+  - `monitoring` (`list[obj]`): Monitoring specifies the configuration of monitoring Policy Controller. When `null`, the `monitoring` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollermonitoringnew) constructor.
+  - `policy_content` (`list[obj]`): Specifies the desired policy content on the cluster. When `null`, the `policy_content` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_contentnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_controller_hub_config` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.new` constructs a new object with attributes and blocks configured for the `deployment_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `component` (`string`): Set the `component` field on the resulting object.
+  - `pod_affinity` (`string`): Pod affinity configuration. Possible values: ["AFFINITY_UNSPECIFIED", "NO_AFFINITY", "ANTI_AFFINITY"] When `null`, the `pod_affinity` field will be omitted from the resulting object.
+  - `replica_count` (`number`): Pod replica count. When `null`, the `replica_count` field will be omitted from the resulting object.
+  - `container_resources` (`list[obj]`): Container resource requirements. When `null`, the `container_resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configcontainer_resourcesnew) constructor.
+  - `pod_toleration` (`list[obj]`): Pod tolerations of node taints. When `null`, the `pod_toleration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configpod_tolerationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `deployment_configs` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.new` constructs a new object with attributes and blocks configured for the `container_resources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `limits` (`list[obj]`): Limits describes the maximum amount of compute resources allowed for use by the running container. When `null`, the `limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configslimitsnew) constructor.
+  - `requests` (`list[obj]`): Requests describes the amount of compute resources reserved for the container by the kube-scheduler. When `null`, the `requests` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configdeployment_configsrequestsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `container_resources` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.limits.new` constructs a new object with attributes and blocks configured for the `limits`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cpu` (`string`): CPU requirement expressed in Kubernetes resource units. When `null`, the `cpu` field will be omitted from the resulting object.
+  - `memory` (`string`): Memory requirement expressed in Kubernetes resource units. When `null`, the `memory` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `limits` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.container_resources.requests.new` constructs a new object with attributes and blocks configured for the `requests`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cpu` (`string`): CPU requirement expressed in Kubernetes resource units. When `null`, the `cpu` field will be omitted from the resulting object.
+  - `memory` (`string`): Memory requirement expressed in Kubernetes resource units. When `null`, the `memory` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `requests` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.deployment_configs.pod_toleration.new` constructs a new object with attributes and blocks configured for the `pod_toleration`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Matches a taint effect. When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Matches a taint key (not necessarily unique). When `null`, the `key` field will be omitted from the resulting object.
+  - `operator` (`string`): Matches a taint operator. When `null`, the `operator` field will be omitted from the resulting object.
+  - `value` (`string`): Matches a taint value. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `pod_toleration` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.monitoring.new` constructs a new object with attributes and blocks configured for the `monitoring`
+Terraform sub block.
+
+
+
+**Args**:
+  - `backends` (`list`): Specifies the list of backends Policy Controller will export to. An empty list would effectively disable metrics export. Possible values: ["MONITORING_BACKEND_UNSPECIFIED", "PROMETHEUS", "CLOUD_MONITORING"] When `null`, the `backends` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `monitoring` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.new` constructs a new object with attributes and blocks configured for the `policy_content`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bundles` (`list[obj]`): Configures which bundles to install and their corresponding install specs. When `null`, the `bundles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configbundlesnew) constructor.
+  - `template_library` (`list[obj]`): Configures the installation of the Template Library. When `null`, the `template_library` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library.new](#fn-fleet_default_member_configfleet_default_member_configpolicycontrollerpolicy_controller_hub_configtemplate_librarynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_content` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.bundles.new` constructs a new object with attributes and blocks configured for the `bundles`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bundle` (`string`): Set the `bundle` field on the resulting object.
+  - `exempted_namespaces` (`list`): The set of namespaces to be exempted from the bundle. When `null`, the `exempted_namespaces` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `bundles` sub block.
+
+
+## obj fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library
+
+
+
+### fn fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.fleet_default_member_config.policycontroller.policy_controller_hub_config.policy_content.template_library.new` constructs a new object with attributes and blocks configured for the `template_library`
+Terraform sub block.
+
+
+
+**Args**:
+  - `installation` (`string`): Configures the manner in which the template library is installed on the cluster. Possible values: ["INSTALATION_UNSPECIFIED", "NOT_INSTALLED", "ALL"] When `null`, the `installation` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `template_library` sub block.
+
+
 ## obj spec
 
 
@@ -261,6 +782,7 @@ Terraform sub block.
 
 
 **Args**:
+  - `clusterupgrade` (`list[obj]`): Clusterupgrade feature spec. When `null`, the `clusterupgrade` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.new](#fn-specclusterupgradenew) constructor.
   - `fleetobservability` (`list[obj]`): Fleet Observability feature spec. When `null`, the `fleetobservability` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.fleetobservability.new](#fn-specfleetobservabilitynew) constructor.
   - `multiclusteringress` (`list[obj]`): Multicluster Ingress-specific spec. When `null`, the `multiclusteringress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.multiclusteringress.new](#fn-specmulticlusteringressnew) constructor.
 
@@ -268,6 +790,125 @@ Terraform sub block.
   - An attribute object that represents the `spec` sub block.
 
 
+## obj spec.clusterupgrade
+
+
+
+### fn spec.clusterupgrade.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.spec.clusterupgrade.new` constructs a new object with attributes and blocks configured for the `clusterupgrade`
+Terraform sub block.
+
+
+
+**Args**:
+  - `upstream_fleets` (`list`): Specified if other fleet should be considered as a source of upgrades. Currently, at most one upstream fleet is allowed. The fleet name should be either fleet project number or id.
+  - `gke_upgrade_overrides` (`list[obj]`): Configuration overrides for individual upgrades. When `null`, the `gke_upgrade_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.new](#fn-specspecgke_upgrade_overridesnew) constructor.
+  - `post_conditions` (`list[obj]`): Post conditions to override for the specified upgrade. When `null`, the `post_conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.post_conditions.new](#fn-specspecpost_conditionsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `clusterupgrade` sub block.
+
+
+## obj spec.clusterupgrade.gke_upgrade_overrides
+
+
+
+### fn spec.clusterupgrade.gke_upgrade_overrides.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.new` constructs a new object with attributes and blocks configured for the `gke_upgrade_overrides`
+Terraform sub block.
+
+
+
+**Args**:
+  - `post_conditions` (`list[obj]`): Post conditions to override for the specified upgrade. When `null`, the `post_conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.post_conditions.new](#fn-specspecclusterupgradepost_conditionsnew) constructor.
+  - `upgrade` (`list[obj]`): Which upgrade to override. When `null`, the `upgrade` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.upgrade.new](#fn-specspecclusterupgradeupgradenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `gke_upgrade_overrides` sub block.
+
+
+## obj spec.clusterupgrade.gke_upgrade_overrides.post_conditions
+
+
+
+### fn spec.clusterupgrade.gke_upgrade_overrides.post_conditions.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.post_conditions.new` constructs a new object with attributes and blocks configured for the `post_conditions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `soaking` (`string`): Amount of time to "soak" after a rollout has been finished before marking it COMPLETE. Cannot exceed 30 days.
+
+**Returns**:
+  - An attribute object that represents the `post_conditions` sub block.
+
+
+## obj spec.clusterupgrade.gke_upgrade_overrides.upgrade
+
+
+
+### fn spec.clusterupgrade.gke_upgrade_overrides.upgrade.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.spec.clusterupgrade.gke_upgrade_overrides.upgrade.new` constructs a new object with attributes and blocks configured for the `upgrade`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the upgrade, e.g., "k8s_control_plane". It should be a valid upgrade name. It must not exceet 99 characters.
+  - `version` (`string`): Version of the upgrade, e.g., "1.22.1-gke.100". It should be a valid version. It must not exceet 99 characters.
+
+**Returns**:
+  - An attribute object that represents the `upgrade` sub block.
+
+
+## obj spec.clusterupgrade.post_conditions
+
+
+
+### fn spec.clusterupgrade.post_conditions.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature.spec.clusterupgrade.post_conditions.new` constructs a new object with attributes and blocks configured for the `post_conditions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `soaking` (`string`): Amount of time to "soak" after a rollout has been finished before marking it COMPLETE. Cannot exceed 30 days.
+
+**Returns**:
+  - An attribute object that represents the `post_conditions` sub block.
+
+
 ## obj spec.fleetobservability
 
 
diff --git a/docs/4.x/gke_hub_feature_membership.md b/docs/4.x/gke_hub_feature_membership.md
index 3385ddfd..219215f7 100644
--- a/docs/4.x/gke_hub_feature_membership.md
+++ b/docs/4.x/gke_hub_feature_membership.md
@@ -20,8 +20,11 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withFeature()`](#fn-withfeature)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembership()`](#fn-withmembership)
+* [`fn withMembershipLocation()`](#fn-withmembershiplocation)
 * [`fn withMesh()`](#fn-withmesh)
 * [`fn withMeshMixin()`](#fn-withmeshmixin)
+* [`fn withPolicycontroller()`](#fn-withpolicycontroller)
+* [`fn withPolicycontrollerMixin()`](#fn-withpolicycontrollermixin)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
@@ -43,6 +46,16 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-configmanagementpolicy_controllermonitoringnew)
 * [`obj mesh`](#obj-mesh)
   * [`fn new()`](#fn-meshnew)
+* [`obj policycontroller`](#obj-policycontroller)
+  * [`fn new()`](#fn-policycontrollernew)
+  * [`obj policycontroller.policy_controller_hub_config`](#obj-policycontrollerpolicy_controller_hub_config)
+    * [`fn new()`](#fn-policycontrollerpolicy_controller_hub_confignew)
+    * [`obj policycontroller.policy_controller_hub_config.monitoring`](#obj-policycontrollerpolicy_controller_hub_configmonitoring)
+      * [`fn new()`](#fn-policycontrollerpolicy_controller_hub_configmonitoringnew)
+    * [`obj policycontroller.policy_controller_hub_config.policy_content`](#obj-policycontrollerpolicy_controller_hub_configpolicy_content)
+      * [`fn new()`](#fn-policycontrollerpolicy_controller_hub_configpolicy_contentnew)
+      * [`obj policycontroller.policy_controller_hub_config.policy_content.template_library`](#obj-policycontrollerpolicy_controller_hub_configpolicy_contenttemplate_library)
+        * [`fn new()`](#fn-policycontrollerpolicy_controller_hub_configpolicy_contenttemplate_librarynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -78,9 +91,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `feature` (`string`): The name of the feature
   - `location` (`string`): The location of the feature
   - `membership` (`string`): The name of the membership
+  - `membership_location` (`string`): The location of the membership When `null`, the `membership_location` field will be omitted from the resulting object.
   - `project` (`string`): The project of the feature When `null`, the `project` field will be omitted from the resulting object.
   - `configmanagement` (`list[obj]`): Config Management-specific spec. When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.new](#fn-configmanagementnew) constructor.
   - `mesh` (`list[obj]`): Manage Mesh Features When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.mesh.new](#fn-meshnew) constructor.
+  - `policycontroller` (`list[obj]`): Policy Controller-specific spec. When `null`, the `policycontroller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.new](#fn-policycontrollernew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -108,9 +123,11 @@ injecting into a complete block.
   - `feature` (`string`): The name of the feature
   - `location` (`string`): The location of the feature
   - `membership` (`string`): The name of the membership
+  - `membership_location` (`string`): The location of the membership When `null`, the `membership_location` field will be omitted from the resulting object.
   - `project` (`string`): The project of the feature When `null`, the `project` field will be omitted from the resulting object.
   - `configmanagement` (`list[obj]`): Config Management-specific spec. When `null`, the `configmanagement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.new](#fn-configmanagementnew) constructor.
   - `mesh` (`list[obj]`): Manage Mesh Features When `null`, the `mesh` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.mesh.new](#fn-meshnew) constructor.
+  - `policycontroller` (`list[obj]`): Policy Controller-specific spec. When `null`, the `policycontroller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.new](#fn-policycontrollernew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -202,6 +219,22 @@ Terraform resource block to set or update the membership field.
   - `value` (`string`): The value to set for the `membership` field.
 
 
+### fn withMembershipLocation
+
+```ts
+withMembershipLocation()
+```
+
+`google.string.withMembershipLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the membership_location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `membership_location` field.
+
+
 ### fn withMesh
 
 ```ts
@@ -239,6 +272,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `mesh` field.
 
 
+### fn withPolicycontroller
+
+```ts
+withPolicycontroller()
+```
+
+`google.list[obj].withPolicycontroller` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the policycontroller field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPolicycontrollerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `policycontroller` field.
+
+
+### fn withPolicycontrollerMixin
+
+```ts
+withPolicycontrollerMixin()
+```
+
+`google.list[obj].withPolicycontrollerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the policycontroller field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPolicycontroller](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `policycontroller` field.
+
+
 ### fn withProject
 
 ```ts
@@ -309,7 +379,7 @@ Terraform sub block.
 
 **Args**:
   - `version` (`string`): Optional. Version of ACM to install. Defaults to the latest version. When `null`, the `version` field will be omitted from the resulting object.
-  - `binauthz` (`list[obj]`): Binauthz configuration for the cluster. When `null`, the `binauthz` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.binauthz.new](#fn-configmanagementbinauthznew) constructor.
+  - `binauthz` (`list[obj]`): **DEPRECATED** Binauthz configuration for the cluster. This field will be ignored and should not be set. When `null`, the `binauthz` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.binauthz.new](#fn-configmanagementbinauthznew) constructor.
   - `config_sync` (`list[obj]`): Config Sync configuration for the cluster. When `null`, the `config_sync` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.new](#fn-configmanagementconfig_syncnew) constructor.
   - `hierarchy_controller` (`list[obj]`): Hierarchy Controller configuration for the cluster. When `null`, the `hierarchy_controller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.hierarchy_controller.new](#fn-configmanagementhierarchy_controllernew) constructor.
   - `policy_controller` (`list[obj]`): Policy Controller configuration for the cluster. When `null`, the `policy_controller` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.policy_controller.new](#fn-configmanagementpolicy_controllernew) constructor.
@@ -358,6 +428,7 @@ Terraform sub block.
 
 
 **Args**:
+  - `metrics_gcp_service_account_email` (`string`): The Email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring. The GSA should have the Monitoring Metric Writer(roles/monitoring.metricWriter) IAM role. The Kubernetes ServiceAccount `default` in the namespace `config-management-monitoring` should be bound to the GSA. When `null`, the `metrics_gcp_service_account_email` field will be omitted from the resulting object.
   - `prevent_drift` (`bool`): Set to true to enable the Config Sync admission webhook to prevent drifts. If set to `false`, disables the Config Sync admission webhook and does not prevent drifts. When `null`, the `prevent_drift` field will be omitted from the resulting object.
   - `source_format` (`string`): Specifies whether the Config Sync Repo is in "hierarchical" or "unstructured" mode. When `null`, the `source_format` field will be omitted from the resulting object.
   - `git` (`list[obj]`): Set the `git` field on the resulting object. When `null`, the `git` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.configmanagement.config_sync.git.new](#fn-configmanagementconfigmanagementgitnew) constructor.
@@ -526,6 +597,130 @@ Terraform sub block.
   - An attribute object that represents the `mesh` sub block.
 
 
+## obj policycontroller
+
+
+
+### fn policycontroller.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature_membership.policycontroller.new` constructs a new object with attributes and blocks configured for the `policycontroller`
+Terraform sub block.
+
+
+
+**Args**:
+  - `version` (`string`): Optional. Version of Policy Controller to install. Defaults to the latest version. When `null`, the `version` field will be omitted from the resulting object.
+  - `policy_controller_hub_config` (`list[obj]`): Policy Controller configuration for the cluster. When `null`, the `policy_controller_hub_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.new](#fn-policycontrollerpolicy_controller_hub_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policycontroller` sub block.
+
+
+## obj policycontroller.policy_controller_hub_config
+
+
+
+### fn policycontroller.policy_controller_hub_config.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.new` constructs a new object with attributes and blocks configured for the `policy_controller_hub_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audit_interval_seconds` (`number`): Sets the interval for Policy Controller Audit Scans (in seconds). When set to 0, this disables audit functionality altogether. When `null`, the `audit_interval_seconds` field will be omitted from the resulting object.
+  - `constraint_violation_limit` (`number`): The maximum number of audit violations to be stored in a constraint. If not set, the internal default of 20 will be used. When `null`, the `constraint_violation_limit` field will be omitted from the resulting object.
+  - `exemptable_namespaces` (`list`): The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. When `null`, the `exemptable_namespaces` field will be omitted from the resulting object.
+  - `install_spec` (`string`): Configures the mode of the Policy Controller installation. Possible values: INSTALL_SPEC_UNSPECIFIED, INSTALL_SPEC_NOT_INSTALLED, INSTALL_SPEC_ENABLED, INSTALL_SPEC_SUSPENDED, INSTALL_SPEC_DETACHED When `null`, the `install_spec` field will be omitted from the resulting object.
+  - `log_denies_enabled` (`bool`): Logs all denies and dry run failures. When `null`, the `log_denies_enabled` field will be omitted from the resulting object.
+  - `mutation_enabled` (`bool`): Enables the ability to mutate resources using Policy Controller. When `null`, the `mutation_enabled` field will be omitted from the resulting object.
+  - `referential_rules_enabled` (`bool`): Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. When `null`, the `referential_rules_enabled` field will be omitted from the resulting object.
+  - `monitoring` (`list[obj]`): Specifies the backends Policy Controller should export metrics to. For example, to specify metrics should be exported to Cloud Monitoring and Prometheus, specify backends: ["cloudmonitoring", "prometheus"]. Default: ["cloudmonitoring", "prometheus"] When `null`, the `monitoring` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.monitoring.new](#fn-policycontrollerpolicycontrollermonitoringnew) constructor.
+  - `policy_content` (`list[obj]`): Specifies the desired policy content on the cluster. When `null`, the `policy_content` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.new](#fn-policycontrollerpolicycontrollerpolicy_contentnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_controller_hub_config` sub block.
+
+
+## obj policycontroller.policy_controller_hub_config.monitoring
+
+
+
+### fn policycontroller.policy_controller_hub_config.monitoring.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.monitoring.new` constructs a new object with attributes and blocks configured for the `monitoring`
+Terraform sub block.
+
+
+
+**Args**:
+  - `backends` (`list`):  Specifies the list of backends Policy Controller will export to. Specifying an empty value `[]` disables metrics export. When `null`, the `backends` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `monitoring` sub block.
+
+
+## obj policycontroller.policy_controller_hub_config.policy_content
+
+
+
+### fn policycontroller.policy_controller_hub_config.policy_content.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.new` constructs a new object with attributes and blocks configured for the `policy_content`
+Terraform sub block.
+
+
+
+**Args**:
+  - `template_library` (`list[obj]`): Configures the installation of the Template Library. When `null`, the `template_library` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.template_library.new](#fn-policycontrollerpolicycontrollerpolicy_controller_hub_configtemplate_librarynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_content` sub block.
+
+
+## obj policycontroller.policy_controller_hub_config.policy_content.template_library
+
+
+
+### fn policycontroller.policy_controller_hub_config.policy_content.template_library.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_feature_membership.policycontroller.policy_controller_hub_config.policy_content.template_library.new` constructs a new object with attributes and blocks configured for the `template_library`
+Terraform sub block.
+
+
+
+**Args**:
+  - `installation` (`string`): Configures the manner in which the template library is installed on the cluster. Possible values: INSTALLATION_UNSPECIFIED, NOT_INSTALLED, ALL When `null`, the `installation` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `template_library` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/gke_hub_fleet.md b/docs/4.x/gke_hub_fleet.md
new file mode 100644
index 00000000..3f6bcc70
--- /dev/null
+++ b/docs/4.x/gke_hub_fleet.md
@@ -0,0 +1,326 @@
+---
+permalink: /gke_hub_fleet/
+---
+
+# gke_hub_fleet
+
+`gke_hub_fleet` represents the `google_gke_hub_fleet` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDefaultClusterConfig()`](#fn-withdefaultclusterconfig)
+* [`fn withDefaultClusterConfigMixin()`](#fn-withdefaultclusterconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj default_cluster_config`](#obj-default_cluster_config)
+  * [`fn new()`](#fn-default_cluster_confignew)
+  * [`obj default_cluster_config.binary_authorization_config`](#obj-default_cluster_configbinary_authorization_config)
+    * [`fn new()`](#fn-default_cluster_configbinary_authorization_confignew)
+    * [`obj default_cluster_config.binary_authorization_config.policy_bindings`](#obj-default_cluster_configbinary_authorization_configpolicy_bindings)
+      * [`fn new()`](#fn-default_cluster_configbinary_authorization_configpolicy_bindingsnew)
+  * [`obj default_cluster_config.security_posture_config`](#obj-default_cluster_configsecurity_posture_config)
+    * [`fn new()`](#fn-default_cluster_configsecurity_posture_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_fleet.new` injects a new `google_gke_hub_fleet` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gke_hub_fleet.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gke_hub_fleet` using the reference:
+
+    $._ref.google_gke_hub_fleet.some_id.get('id')
+
+This is the same as directly entering `"${ google_gke_hub_fleet.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.
+Allowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `default_cluster_config` (`list[obj]`): The default cluster configurations to apply across the fleet. When `null`, the `default_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.new](#fn-default_cluster_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gke_hub_fleet.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_fleet`
+Terraform resource.
+
+Unlike [google.gke_hub_fleet.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.
+Allowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `default_cluster_config` (`list[obj]`): The default cluster configurations to apply across the fleet. When `null`, the `default_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.new](#fn-default_cluster_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_fleet` resource into the root Terraform configuration.
+
+
+### fn withDefaultClusterConfig
+
+```ts
+withDefaultClusterConfig()
+```
+
+`google.list[obj].withDefaultClusterConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the default_cluster_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDefaultClusterConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `default_cluster_config` field.
+
+
+### fn withDefaultClusterConfigMixin
+
+```ts
+withDefaultClusterConfigMixin()
+```
+
+`google.list[obj].withDefaultClusterConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the default_cluster_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDefaultClusterConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `default_cluster_config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj default_cluster_config
+
+
+
+### fn default_cluster_config.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_fleet.default_cluster_config.new` constructs a new object with attributes and blocks configured for the `default_cluster_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `binary_authorization_config` (`list[obj]`): Enable/Disable binary authorization features for the cluster. When `null`, the `binary_authorization_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.binary_authorization_config.new](#fn-default_cluster_configbinary_authorization_confignew) constructor.
+  - `security_posture_config` (`list[obj]`): Enable/Disable Security Posture features for the cluster. When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.security_posture_config.new](#fn-default_cluster_configsecurity_posture_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `default_cluster_config` sub block.
+
+
+## obj default_cluster_config.binary_authorization_config
+
+
+
+### fn default_cluster_config.binary_authorization_config.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_fleet.default_cluster_config.binary_authorization_config.new` constructs a new object with attributes and blocks configured for the `binary_authorization_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `evaluation_mode` (`string`): Mode of operation for binauthz policy evaluation. Possible values: ["DISABLED", "POLICY_BINDINGS"] When `null`, the `evaluation_mode` field will be omitted from the resulting object.
+  - `policy_bindings` (`list[obj]`): Binauthz policies that apply to this cluster. When `null`, the `policy_bindings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.default_cluster_config.binary_authorization_config.policy_bindings.new](#fn-default_cluster_configdefault_cluster_configpolicy_bindingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `binary_authorization_config` sub block.
+
+
+## obj default_cluster_config.binary_authorization_config.policy_bindings
+
+
+
+### fn default_cluster_config.binary_authorization_config.policy_bindings.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_fleet.default_cluster_config.binary_authorization_config.policy_bindings.new` constructs a new object with attributes and blocks configured for the `policy_bindings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): The relative resource name of the binauthz platform policy to audit. GKE
+platform policies have the following format:
+'projects/{project_number}/platforms/gke/policies/{policy_id}'. When `null`, the `name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `policy_bindings` sub block.
+
+
+## obj default_cluster_config.security_posture_config
+
+
+
+### fn default_cluster_config.security_posture_config.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_fleet.default_cluster_config.security_posture_config.new` constructs a new object with attributes and blocks configured for the `security_posture_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `mode` (`string`): Sets which mode to use for Security Posture features. Possible values: ["DISABLED", "BASIC"] When `null`, the `mode` field will be omitted from the resulting object.
+  - `vulnerability_mode` (`string`): Sets which mode to use for vulnerability scanning. Possible values: ["VULNERABILITY_DISABLED", "VULNERABILITY_BASIC", "VULNERABILITY_ENTERPRISE"] When `null`, the `vulnerability_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `security_posture_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gke_hub_fleet.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gke_hub_membership.md b/docs/4.x/gke_hub_membership.md
index a956d279..c4544519 100644
--- a/docs/4.x/gke_hub_membership.md
+++ b/docs/4.x/gke_hub_membership.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEndpoint()`](#fn-withendpoint)
 * [`fn withEndpointMixin()`](#fn-withendpointmixin)
 * [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -62,7 +63,13 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this membership.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location of the membership.
+The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): The client-provided identifier of the membership.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.
@@ -93,7 +100,13 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this membership.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location of the membership.
+The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): The client-provided identifier of the membership.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.
@@ -196,6 +209,22 @@ Terraform resource block to set or update the labels field.
   - `value` (`obj`): The value to set for the `labels` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembershipId
 
 ```ts
diff --git a/docs/4.x/gke_hub_membership_binding.md b/docs/4.x/gke_hub_membership_binding.md
index 16c2cbc5..9fcaba26 100644
--- a/docs/4.x/gke_hub_membership_binding.md
+++ b/docs/4.x/gke_hub_membership_binding.md
@@ -55,7 +55,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Membership binding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the membership
   - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.
   - `membership_id` (`string`): Id of the membership
@@ -86,7 +90,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Membership binding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the membership
   - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.
   - `membership_id` (`string`): Id of the membership
diff --git a/docs/4.x/gke_hub_membership_iam_binding.md b/docs/4.x/gke_hub_membership_iam_binding.md
index 4cb96e86..6ada917c 100644
--- a/docs/4.x/gke_hub_membership_iam_binding.md
+++ b/docs/4.x/gke_hub_membership_iam_binding.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembers()`](#fn-withmembers)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
@@ -53,6 +54,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `members` (`list`): Set the `members` field on the resulting resource block.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -81,6 +83,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `members` (`list`): Set the `members` field on the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -128,6 +131,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `condition` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembers
 
 ```ts
diff --git a/docs/4.x/gke_hub_membership_iam_member.md b/docs/4.x/gke_hub_membership_iam_member.md
index b73c3564..33247ae0 100644
--- a/docs/4.x/gke_hub_membership_iam_member.md
+++ b/docs/4.x/gke_hub_membership_iam_member.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMember()`](#fn-withmember)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
@@ -53,6 +54,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `member` (`string`): Set the `member` field on the resulting resource block.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -81,6 +83,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `member` (`string`): Set the `member` field on the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -128,6 +131,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `condition` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMember
 
 ```ts
diff --git a/docs/4.x/gke_hub_membership_iam_policy.md b/docs/4.x/gke_hub_membership_iam_policy.md
index dc334b68..80fc657c 100644
--- a/docs/4.x/gke_hub_membership_iam_policy.md
+++ b/docs/4.x/gke_hub_membership_iam_policy.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withPolicyData()`](#fn-withpolicydata)
 * [`fn withProject()`](#fn-withproject)
@@ -48,6 +49,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -74,6 +76,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -82,6 +85,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_policy` resource into the root Terraform configuration.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembershipId
 
 ```ts
diff --git a/docs/4.x/gke_hub_namespace.md b/docs/4.x/gke_hub_namespace.md
index 0b9fd050..f259b8e3 100644
--- a/docs/4.x/gke_hub_namespace.md
+++ b/docs/4.x/gke_hub_namespace.md
@@ -55,7 +55,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Namespace.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied
 to the related namespace of the member clusters bound to the parent
 Scope. Scope-level labels ('namespace_labels' in the Fleet Scope
@@ -89,7 +93,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Namespace.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied
 to the related namespace of the member clusters bound to the parent
 Scope. Scope-level labels ('namespace_labels' in the Fleet Scope
diff --git a/docs/4.x/gke_hub_scope.md b/docs/4.x/gke_hub_scope.md
index 854a4a5c..1f0169ea 100644
--- a/docs/4.x/gke_hub_scope.md
+++ b/docs/4.x/gke_hub_scope.md
@@ -52,7 +52,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Scope.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): The client-provided identifier of the scope.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.
@@ -79,7 +83,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Scope.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): The client-provided identifier of the scope.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/gke_hub_scope_rbac_role_binding.md b/docs/4.x/gke_hub_scope_rbac_role_binding.md
index 267a0bea..51ee0424 100644
--- a/docs/4.x/gke_hub_scope_rbac_role_binding.md
+++ b/docs/4.x/gke_hub_scope_rbac_role_binding.md
@@ -62,7 +62,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof
 is required). Updating one will unset the other automatically.
 group is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): Id of the scope
   - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.
@@ -98,7 +102,11 @@ injecting into a complete block.
   - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof
 is required). Updating one will unset the other automatically.
 group is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): Id of the scope
   - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.
diff --git a/docs/4.x/gkeonprem_bare_metal_admin_cluster.md b/docs/4.x/gkeonprem_bare_metal_admin_cluster.md
new file mode 100644
index 00000000..a6a0f74d
--- /dev/null
+++ b/docs/4.x/gkeonprem_bare_metal_admin_cluster.md
@@ -0,0 +1,1337 @@
+---
+permalink: /gkeonprem_bare_metal_admin_cluster/
+---
+
+# gkeonprem_bare_metal_admin_cluster
+
+`gkeonprem_bare_metal_admin_cluster` represents the `google_gkeonprem_bare_metal_admin_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withBareMetalVersion()`](#fn-withbaremetalversion)
+* [`fn withClusterOperations()`](#fn-withclusteroperations)
+* [`fn withClusterOperationsMixin()`](#fn-withclusteroperationsmixin)
+* [`fn withControlPlane()`](#fn-withcontrolplane)
+* [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLoadBalancer()`](#fn-withloadbalancer)
+* [`fn withLoadBalancerMixin()`](#fn-withloadbalancermixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMaintenanceConfig()`](#fn-withmaintenanceconfig)
+* [`fn withMaintenanceConfigMixin()`](#fn-withmaintenanceconfigmixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withNodeAccessConfig()`](#fn-withnodeaccessconfig)
+* [`fn withNodeAccessConfigMixin()`](#fn-withnodeaccessconfigmixin)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withProxy()`](#fn-withproxy)
+* [`fn withProxyMixin()`](#fn-withproxymixin)
+* [`fn withSecurityConfig()`](#fn-withsecurityconfig)
+* [`fn withSecurityConfigMixin()`](#fn-withsecurityconfigmixin)
+* [`fn withStorage()`](#fn-withstorage)
+* [`fn withStorageMixin()`](#fn-withstoragemixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj cluster_operations`](#obj-cluster_operations)
+  * [`fn new()`](#fn-cluster_operationsnew)
+* [`obj control_plane`](#obj-control_plane)
+  * [`fn new()`](#fn-control_planenew)
+  * [`obj control_plane.api_server_args`](#obj-control_planeapi_server_args)
+    * [`fn new()`](#fn-control_planeapi_server_argsnew)
+  * [`obj control_plane.control_plane_node_pool_config`](#obj-control_planecontrol_plane_node_pool_config)
+    * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignew)
+    * [`obj control_plane.control_plane_node_pool_config.node_pool_config`](#obj-control_planecontrol_plane_node_pool_confignode_pool_config)
+      * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs`](#obj-control_planecontrol_plane_node_pool_confignode_pool_confignode_configs)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignode_configsnew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.taints`](#obj-control_planecontrol_plane_node_pool_confignode_pool_configtaints)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_configtaintsnew)
+* [`obj load_balancer`](#obj-load_balancer)
+  * [`fn new()`](#fn-load_balancernew)
+  * [`obj load_balancer.manual_lb_config`](#obj-load_balancermanual_lb_config)
+    * [`fn new()`](#fn-load_balancermanual_lb_confignew)
+  * [`obj load_balancer.port_config`](#obj-load_balancerport_config)
+    * [`fn new()`](#fn-load_balancerport_confignew)
+  * [`obj load_balancer.vip_config`](#obj-load_balancervip_config)
+    * [`fn new()`](#fn-load_balancervip_confignew)
+* [`obj maintenance_config`](#obj-maintenance_config)
+  * [`fn new()`](#fn-maintenance_confignew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.island_mode_cidr`](#obj-network_configisland_mode_cidr)
+    * [`fn new()`](#fn-network_configisland_mode_cidrnew)
+* [`obj node_access_config`](#obj-node_access_config)
+  * [`fn new()`](#fn-node_access_confignew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj proxy`](#obj-proxy)
+  * [`fn new()`](#fn-proxynew)
+* [`obj security_config`](#obj-security_config)
+  * [`fn new()`](#fn-security_confignew)
+  * [`obj security_config.authorization`](#obj-security_configauthorization)
+    * [`fn new()`](#fn-security_configauthorizationnew)
+    * [`obj security_config.authorization.admin_users`](#obj-security_configauthorizationadmin_users)
+      * [`fn new()`](#fn-security_configauthorizationadmin_usersnew)
+* [`obj storage`](#obj-storage)
+  * [`fn new()`](#fn-storagenew)
+  * [`obj storage.lvp_node_mounts_config`](#obj-storagelvp_node_mounts_config)
+    * [`fn new()`](#fn-storagelvp_node_mounts_confignew)
+  * [`obj storage.lvp_share_config`](#obj-storagelvp_share_config)
+    * [`fn new()`](#fn-storagelvp_share_confignew)
+    * [`obj storage.lvp_share_config.lvp_config`](#obj-storagelvp_share_configlvp_config)
+      * [`fn new()`](#fn-storagelvp_share_configlvp_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.new` injects a new `google_gkeonprem_bare_metal_admin_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_bare_metal_admin_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_admin_cluster` using the reference:
+
+    $._ref.google_gkeonprem_bare_metal_admin_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_bare_metal_admin_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal admin cluster name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_admin_cluster`
+Terraform resource.
+
+Unlike [google.gkeonprem_bare_metal_admin_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal admin cluster name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_admin_cluster` resource into the root Terraform configuration.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withBareMetalVersion
+
+```ts
+withBareMetalVersion()
+```
+
+`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the bare_metal_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `bare_metal_version` field.
+
+
+### fn withClusterOperations
+
+```ts
+withClusterOperations()
+```
+
+`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withClusterOperationsMixin
+
+```ts
+withClusterOperationsMixin()
+```
+
+`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withControlPlane
+
+```ts
+withControlPlane()
+```
+
+`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withControlPlaneMixin
+
+```ts
+withControlPlaneMixin()
+```
+
+`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLoadBalancer
+
+```ts
+withLoadBalancer()
+```
+
+`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLoadBalancerMixin
+
+```ts
+withLoadBalancerMixin()
+```
+
+`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMaintenanceConfig
+
+```ts
+withMaintenanceConfig()
+```
+
+`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withMaintenanceConfigMixin
+
+```ts
+withMaintenanceConfigMixin()
+```
+
+`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNodeAccessConfig
+
+```ts
+withNodeAccessConfig()
+```
+
+`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeAccessConfigMixin
+
+```ts
+withNodeAccessConfigMixin()
+```
+
+`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withProxy
+
+```ts
+withProxy()
+```
+
+`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withProxyMixin
+
+```ts
+withProxyMixin()
+```
+
+`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withSecurityConfig
+
+```ts
+withSecurityConfig()
+```
+
+`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withSecurityConfigMixin
+
+```ts
+withSecurityConfigMixin()
+```
+
+`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withStorage
+
+```ts
+withStorage()
+```
+
+`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withStorageMixin
+
+```ts
+withStorageMixin()
+```
+
+`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj cluster_operations
+
+
+
+### fn cluster_operations.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `cluster_operations` sub block.
+
+
+## obj control_plane
+
+
+
+### fn control_plane.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`
+Terraform sub block.
+
+
+
+**Args**:
+  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of
+customized flags are supported. Please refer to the API server
+documentation below to know the exact format:
+https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.
+  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane` sub block.
+
+
+## obj control_plane.api_server_args
+
+
+
+### fn control_plane.api_server_args.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`
+Terraform sub block.
+
+
+
+**Args**:
+  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.
+  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.
+
+**Returns**:
+  - An attribute object that represents the `api_server_args` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.taints
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer
+
+
+
+### fn load_balancer.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.
+  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.
+  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer` sub block.
+
+
+## obj load_balancer.manual_lb_config
+
+
+
+### fn load_balancer.manual_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether manual load balancing is enabled.
+
+**Returns**:
+  - An attribute object that represents the `manual_lb_config` sub block.
+
+
+## obj load_balancer.port_config
+
+
+
+### fn load_balancer.port_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.
+
+**Returns**:
+  - An attribute object that represents the `port_config` sub block.
+
+
+## obj load_balancer.vip_config
+
+
+
+### fn load_balancer.vip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal Admin Cluster.
+
+**Returns**:
+  - An attribute object that represents the `vip_config` sub block.
+
+
+## obj maintenance_config
+
+
+
+### fn maintenance_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.
+Nodes in maintenance mode will be cordoned and drained. When both of these
+are true, the "baremetal.cluster.gke.io/maintenance" annotation will be set
+on the node resource.
+
+**Returns**:
+  - An attribute object that represents the `maintenance_config` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj network_config.island_mode_cidr
+
+
+
+### fn network_config.island_mode_cidr.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+
+**Returns**:
+  - An attribute object that represents the `island_mode_cidr` sub block.
+
+
+## obj node_access_config
+
+
+
+### fn node_access_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `login_user` (`string`): LoginUser is the user name used to access node machines.
+It defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_access_config` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range
+assigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj proxy
+
+
+
+### fn proxy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.
+Examples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.
+  - `uri` (`string`): Specifies the address of your proxy server.
+Examples: http://domain
+WARNING: Do not provide credentials in the format
+http://(username:password@)domain these will be rejected by the server.
+
+**Returns**:
+  - An attribute object that represents the `proxy` sub block.
+
+
+## obj security_config
+
+
+
+### fn security_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `security_config` sub block.
+
+
+## obj security_config.authorization
+
+
+
+### fn security_config.authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj security_config.authorization.admin_users
+
+
+
+### fn security_config.authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj storage
+
+
+
+### fn storage.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`
+Terraform sub block.
+
+
+
+**Args**:
+  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed
+by mounted node disks. These disks need to be formatted and mounted by the
+user, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.
+  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by
+subdirectories in a shared filesystem. These subdirectores are
+automatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `storage` sub block.
+
+
+## obj storage.lvp_node_mounts_config
+
+
+
+### fn storage.lvp_node_mounts_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_node_mounts_config` sub block.
+
+
+## obj storage.lvp_share_config
+
+
+
+### fn storage.lvp_share_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.
+  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `lvp_share_config` sub block.
+
+
+## obj storage.lvp_share_config.lvp_config
+
+
+
+### fn storage.lvp_share_config.lvp_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gkeonprem_bare_metal_cluster.md b/docs/4.x/gkeonprem_bare_metal_cluster.md
new file mode 100644
index 00000000..a935b900
--- /dev/null
+++ b/docs/4.x/gkeonprem_bare_metal_cluster.md
@@ -0,0 +1,2066 @@
+---
+permalink: /gkeonprem_bare_metal_cluster/
+---
+
+# gkeonprem_bare_metal_cluster
+
+`gkeonprem_bare_metal_cluster` represents the `google_gkeonprem_bare_metal_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdminClusterMembership()`](#fn-withadminclustermembership)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withBareMetalVersion()`](#fn-withbaremetalversion)
+* [`fn withBinaryAuthorization()`](#fn-withbinaryauthorization)
+* [`fn withBinaryAuthorizationMixin()`](#fn-withbinaryauthorizationmixin)
+* [`fn withClusterOperations()`](#fn-withclusteroperations)
+* [`fn withClusterOperationsMixin()`](#fn-withclusteroperationsmixin)
+* [`fn withControlPlane()`](#fn-withcontrolplane)
+* [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLoadBalancer()`](#fn-withloadbalancer)
+* [`fn withLoadBalancerMixin()`](#fn-withloadbalancermixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMaintenanceConfig()`](#fn-withmaintenanceconfig)
+* [`fn withMaintenanceConfigMixin()`](#fn-withmaintenanceconfigmixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withNodeAccessConfig()`](#fn-withnodeaccessconfig)
+* [`fn withNodeAccessConfigMixin()`](#fn-withnodeaccessconfigmixin)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withOsEnvironmentConfig()`](#fn-withosenvironmentconfig)
+* [`fn withOsEnvironmentConfigMixin()`](#fn-withosenvironmentconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withProxy()`](#fn-withproxy)
+* [`fn withProxyMixin()`](#fn-withproxymixin)
+* [`fn withSecurityConfig()`](#fn-withsecurityconfig)
+* [`fn withSecurityConfigMixin()`](#fn-withsecurityconfigmixin)
+* [`fn withStorage()`](#fn-withstorage)
+* [`fn withStorageMixin()`](#fn-withstoragemixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUpgradePolicy()`](#fn-withupgradepolicy)
+* [`fn withUpgradePolicyMixin()`](#fn-withupgradepolicymixin)
+* [`obj binary_authorization`](#obj-binary_authorization)
+  * [`fn new()`](#fn-binary_authorizationnew)
+* [`obj cluster_operations`](#obj-cluster_operations)
+  * [`fn new()`](#fn-cluster_operationsnew)
+* [`obj control_plane`](#obj-control_plane)
+  * [`fn new()`](#fn-control_planenew)
+  * [`obj control_plane.api_server_args`](#obj-control_planeapi_server_args)
+    * [`fn new()`](#fn-control_planeapi_server_argsnew)
+  * [`obj control_plane.control_plane_node_pool_config`](#obj-control_planecontrol_plane_node_pool_config)
+    * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignew)
+    * [`obj control_plane.control_plane_node_pool_config.node_pool_config`](#obj-control_planecontrol_plane_node_pool_confignode_pool_config)
+      * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs`](#obj-control_planecontrol_plane_node_pool_confignode_pool_confignode_configs)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignode_configsnew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.taints`](#obj-control_planecontrol_plane_node_pool_confignode_pool_configtaints)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_configtaintsnew)
+* [`obj load_balancer`](#obj-load_balancer)
+  * [`fn new()`](#fn-load_balancernew)
+  * [`obj load_balancer.bgp_lb_config`](#obj-load_balancerbgp_lb_config)
+    * [`fn new()`](#fn-load_balancerbgp_lb_confignew)
+    * [`obj load_balancer.bgp_lb_config.address_pools`](#obj-load_balancerbgp_lb_configaddress_pools)
+      * [`fn new()`](#fn-load_balancerbgp_lb_configaddress_poolsnew)
+    * [`obj load_balancer.bgp_lb_config.bgp_peer_configs`](#obj-load_balancerbgp_lb_configbgp_peer_configs)
+      * [`fn new()`](#fn-load_balancerbgp_lb_configbgp_peer_configsnew)
+    * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_config)
+      * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignew)
+      * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_config)
+        * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_confignew)
+        * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configkubelet_config)
+          * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configkubelet_confignew)
+        * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_confignode_configs)
+          * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_confignode_configsnew)
+        * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configtaints)
+          * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configtaintsnew)
+  * [`obj load_balancer.manual_lb_config`](#obj-load_balancermanual_lb_config)
+    * [`fn new()`](#fn-load_balancermanual_lb_confignew)
+  * [`obj load_balancer.metal_lb_config`](#obj-load_balancermetal_lb_config)
+    * [`fn new()`](#fn-load_balancermetal_lb_confignew)
+    * [`obj load_balancer.metal_lb_config.address_pools`](#obj-load_balancermetal_lb_configaddress_pools)
+      * [`fn new()`](#fn-load_balancermetal_lb_configaddress_poolsnew)
+    * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config`](#obj-load_balancermetal_lb_configload_balancer_node_pool_config)
+      * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignew)
+      * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config`](#obj-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_config)
+        * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_confignew)
+        * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs`](#obj-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_confignode_configs)
+          * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_confignode_configsnew)
+        * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints`](#obj-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_configtaints)
+          * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_configtaintsnew)
+  * [`obj load_balancer.port_config`](#obj-load_balancerport_config)
+    * [`fn new()`](#fn-load_balancerport_confignew)
+  * [`obj load_balancer.vip_config`](#obj-load_balancervip_config)
+    * [`fn new()`](#fn-load_balancervip_confignew)
+* [`obj maintenance_config`](#obj-maintenance_config)
+  * [`fn new()`](#fn-maintenance_confignew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.island_mode_cidr`](#obj-network_configisland_mode_cidr)
+    * [`fn new()`](#fn-network_configisland_mode_cidrnew)
+  * [`obj network_config.multiple_network_interfaces_config`](#obj-network_configmultiple_network_interfaces_config)
+    * [`fn new()`](#fn-network_configmultiple_network_interfaces_confignew)
+  * [`obj network_config.sr_iov_config`](#obj-network_configsr_iov_config)
+    * [`fn new()`](#fn-network_configsr_iov_confignew)
+* [`obj node_access_config`](#obj-node_access_config)
+  * [`fn new()`](#fn-node_access_confignew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj os_environment_config`](#obj-os_environment_config)
+  * [`fn new()`](#fn-os_environment_confignew)
+* [`obj proxy`](#obj-proxy)
+  * [`fn new()`](#fn-proxynew)
+* [`obj security_config`](#obj-security_config)
+  * [`fn new()`](#fn-security_confignew)
+  * [`obj security_config.authorization`](#obj-security_configauthorization)
+    * [`fn new()`](#fn-security_configauthorizationnew)
+    * [`obj security_config.authorization.admin_users`](#obj-security_configauthorizationadmin_users)
+      * [`fn new()`](#fn-security_configauthorizationadmin_usersnew)
+* [`obj storage`](#obj-storage)
+  * [`fn new()`](#fn-storagenew)
+  * [`obj storage.lvp_node_mounts_config`](#obj-storagelvp_node_mounts_config)
+    * [`fn new()`](#fn-storagelvp_node_mounts_confignew)
+  * [`obj storage.lvp_share_config`](#obj-storagelvp_share_config)
+    * [`fn new()`](#fn-storagelvp_share_confignew)
+    * [`obj storage.lvp_share_config.lvp_config`](#obj-storagelvp_share_configlvp_config)
+      * [`fn new()`](#fn-storagelvp_share_configlvp_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj upgrade_policy`](#obj-upgrade_policy)
+  * [`fn new()`](#fn-upgrade_policynew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.new` injects a new `google_gkeonprem_bare_metal_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_bare_metal_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_cluster` using the reference:
+
+    $._ref.google_gkeonprem_bare_metal_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_bare_metal_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.
+This is the full resource name of the Admin Cluster's hub membership.
+  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.
+  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal cluster name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
+  - `cluster_operations` (`list[obj]`): Specifies the User Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_cluster`
+Terraform resource.
+
+Unlike [google.gkeonprem_bare_metal_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.
+This is the full resource name of the Admin Cluster's hub membership.
+  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.
+  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal cluster name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
+  - `cluster_operations` (`list[obj]`): Specifies the User Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_cluster` resource into the root Terraform configuration.
+
+
+### fn withAdminClusterMembership
+
+```ts
+withAdminClusterMembership()
+```
+
+`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the admin_cluster_membership field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `admin_cluster_membership` field.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withBareMetalVersion
+
+```ts
+withBareMetalVersion()
+```
+
+`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the bare_metal_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `bare_metal_version` field.
+
+
+### fn withBinaryAuthorization
+
+```ts
+withBinaryAuthorization()
+```
+
+`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
+### fn withBinaryAuthorizationMixin
+
+```ts
+withBinaryAuthorizationMixin()
+```
+
+`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
+### fn withClusterOperations
+
+```ts
+withClusterOperations()
+```
+
+`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withClusterOperationsMixin
+
+```ts
+withClusterOperationsMixin()
+```
+
+`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withControlPlane
+
+```ts
+withControlPlane()
+```
+
+`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withControlPlaneMixin
+
+```ts
+withControlPlaneMixin()
+```
+
+`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLoadBalancer
+
+```ts
+withLoadBalancer()
+```
+
+`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLoadBalancerMixin
+
+```ts
+withLoadBalancerMixin()
+```
+
+`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMaintenanceConfig
+
+```ts
+withMaintenanceConfig()
+```
+
+`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withMaintenanceConfigMixin
+
+```ts
+withMaintenanceConfigMixin()
+```
+
+`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNodeAccessConfig
+
+```ts
+withNodeAccessConfig()
+```
+
+`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeAccessConfigMixin
+
+```ts
+withNodeAccessConfigMixin()
+```
+
+`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withOsEnvironmentConfig
+
+```ts
+withOsEnvironmentConfig()
+```
+
+`google.list[obj].withOsEnvironmentConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the os_environment_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withOsEnvironmentConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.
+
+
+### fn withOsEnvironmentConfigMixin
+
+```ts
+withOsEnvironmentConfigMixin()
+```
+
+`google.list[obj].withOsEnvironmentConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the os_environment_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withOsEnvironmentConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withProxy
+
+```ts
+withProxy()
+```
+
+`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withProxyMixin
+
+```ts
+withProxyMixin()
+```
+
+`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withSecurityConfig
+
+```ts
+withSecurityConfig()
+```
+
+`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withSecurityConfigMixin
+
+```ts
+withSecurityConfigMixin()
+```
+
+`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withStorage
+
+```ts
+withStorage()
+```
+
+`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withStorageMixin
+
+```ts
+withStorageMixin()
+```
+
+`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUpgradePolicy
+
+```ts
+withUpgradePolicy()
+```
+
+`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+### fn withUpgradePolicyMixin
+
+```ts
+withUpgradePolicyMixin()
+```
+
+`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+## obj binary_authorization
+
+
+
+### fn binary_authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `evaluation_mode` (`string`): Mode of operation for binauthz policy evaluation. If unspecified,
+defaults to DISABLED. Possible values: ["DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"] When `null`, the `evaluation_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `binary_authorization` sub block.
+
+
+## obj cluster_operations
+
+
+
+### fn cluster_operations.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `cluster_operations` sub block.
+
+
+## obj control_plane
+
+
+
+### fn control_plane.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`
+Terraform sub block.
+
+
+
+**Args**:
+  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of
+customized flags are supported. Please refer to the API server
+documentation below to know the exact format:
+https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.
+  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane` sub block.
+
+
+## obj control_plane.api_server_args
+
+
+
+### fn control_plane.api_server_args.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`
+Terraform sub block.
+
+
+
+**Args**:
+  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.
+  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.
+
+**Returns**:
+  - An attribute object that represents the `api_server_args` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.taints
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer
+
+
+
+### fn load_balancer.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bgp_lb_config` (`list[obj]`): Configuration for BGP typed load balancers. When `null`, the `bgp_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new](#fn-load_balancerbgp_lb_confignew) constructor.
+  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.
+  - `metal_lb_config` (`list[obj]`): A nested object resource When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.
+  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.
+  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer` sub block.
+
+
+## obj load_balancer.bgp_lb_config
+
+
+
+### fn load_balancer.bgp_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new` constructs a new object with attributes and blocks configured for the `bgp_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `asn` (`number`): BGP autonomous system number (ASN) of the cluster.
+This field can be updated after cluster creation.
+  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer
+typed services. All addresses must be routable to load balancer nodes.
+IngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.
+  - `bgp_peer_configs` (`list[obj]`): The list of BGP peers that the cluster will connect to.
+At least one peer must be configured for each control plane node.
+Control plane nodes will connect to these peers to advertise the control
+plane VIP. The Services load balancer also uses these peers by default.
+This field can be updated after cluster creation. When `null`, the `bgp_peer_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new](#fn-load_balancerload_balancerbgp_peer_configsnew) constructor.
+  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the node pool running data plane load balancing. L2 connectivity
+is required among nodes in this pool. If missing, the control plane node
+pool is used for data plane load balancing. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `bgp_lb_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.address_pools
+
+
+
+### fn load_balancer.bgp_lb_config.address_pools.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`
+Terraform sub block.
+
+
+
+**Args**:
+  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).
+  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.
+This avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.
+  - `manual_assign` (`string`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.
+  - `pool` (`string`): The name of the address pool.
+
+**Returns**:
+  - An attribute object that represents the `address_pools` sub block.
+
+
+## obj load_balancer.bgp_lb_config.bgp_peer_configs
+
+
+
+### fn load_balancer.bgp_lb_config.bgp_peer_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new` constructs a new object with attributes and blocks configured for the `bgp_peer_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `asn` (`number`): BGP autonomous system number (ASN) for the network that contains the
+external peer device.
+  - `control_plane_nodes` (`list`): The IP address of the control plane node that connects to the external
+peer.
+If you don't specify any control plane nodes, all control plane nodes
+can connect to the external peer. If you specify one or more IP addresses,
+only the nodes specified participate in peering sessions. When `null`, the `control_plane_nodes` field will be omitted from the resulting object.
+  - `ip_address` (`string`): The IP address of the external peer device.
+
+**Returns**:
+  - An attribute object that represents the `bgp_peer_configs` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancerbgp_lb_confignode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer_node_pool_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `kubelet_config` (`list[obj]`): The modifiable kubelet configurations for the baremetal machines. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configkubelet_confignew) constructor.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new` constructs a new object with attributes and blocks configured for the `kubelet_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `registry_burst` (`number`): The maximum size of bursty pulls, temporarily allows pulls to burst to this
+number, while still not exceeding registry_pull_qps.
+The value must not be a negative number.
+Updating this field may impact scalability by changing the amount of
+traffic produced by image pulls.
+Defaults to 10. When `null`, the `registry_burst` field will be omitted from the resulting object.
+  - `registry_pull_qps` (`number`): The limit of registry pulls per second.
+Setting this value to 0 means no limit.
+Updating this field may impact scalability by changing the amount of
+traffic produced by image pulls.
+Defaults to 5. When `null`, the `registry_pull_qps` field will be omitted from the resulting object.
+  - `serialize_image_pulls_disabled` (`bool`): Prevents the Kubelet from pulling multiple images at a time.
+We recommend *not* changing the default value on nodes that run docker
+daemon with version  < 1.9 or an Another Union File System (Aufs) storage
+backend. Issue https://github.com/kubernetes/kubernetes/issues/10959 has
+more details. When `null`, the `serialize_image_pulls_disabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `kubelet_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer.manual_lb_config
+
+
+
+### fn load_balancer.manual_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether manual load balancing is enabled.
+
+**Returns**:
+  - An attribute object that represents the `manual_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config
+
+
+
+### fn load_balancer.metal_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer
+typed services. All addresses must be routable to load balancer nodes.
+IngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.
+  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the load balancer's node pool configuration. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `metal_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.address_pools
+
+
+
+### fn load_balancer.metal_lb_config.address_pools.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`
+Terraform sub block.
+
+
+
+**Args**:
+  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).
+  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.
+This avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.
+  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.
+  - `pool` (`string`): The name of the address pool.
+
+**Returns**:
+  - An attribute object that represents the `address_pools` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancermetal_lb_confignode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer_node_pool_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer.port_config
+
+
+
+### fn load_balancer.port_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.
+
+**Returns**:
+  - An attribute object that represents the `port_config` sub block.
+
+
+## obj load_balancer.vip_config
+
+
+
+### fn load_balancer.vip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal User Cluster.
+  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this Bare Metal User Cluster.
+
+**Returns**:
+  - An attribute object that represents the `vip_config` sub block.
+
+
+## obj maintenance_config
+
+
+
+### fn maintenance_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.
+Nodes in maintenance mode will be cordoned and drained. When both of these
+are true, the "baremetal.cluster.gke.io/maintenance" annotation will be set
+on the node resource.
+
+**Returns**:
+  - An attribute object that represents the `maintenance_config` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `advanced_networking` (`bool`): Enables the use of advanced Anthos networking features, such as Bundled
+Load Balancing with BGP or the egress NAT gateway.
+Setting configuration for advanced networking features will automatically
+set this flag. When `null`, the `advanced_networking` field will be omitted from the resulting object.
+  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.
+  - `multiple_network_interfaces_config` (`list[obj]`): Configuration for multiple network interfaces. When `null`, the `multiple_network_interfaces_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new](#fn-network_configmultiple_network_interfaces_confignew) constructor.
+  - `sr_iov_config` (`list[obj]`): Configuration for SR-IOV. When `null`, the `sr_iov_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new](#fn-network_configsr_iov_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj network_config.island_mode_cidr
+
+
+
+### fn network_config.island_mode_cidr.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+
+**Returns**:
+  - An attribute object that represents the `island_mode_cidr` sub block.
+
+
+## obj network_config.multiple_network_interfaces_config
+
+
+
+### fn network_config.multiple_network_interfaces_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new` constructs a new object with attributes and blocks configured for the `multiple_network_interfaces_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to enable multiple network interfaces for your pods.
+When set network_config.advanced_networking is automatically
+set to true. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `multiple_network_interfaces_config` sub block.
+
+
+## obj network_config.sr_iov_config
+
+
+
+### fn network_config.sr_iov_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new` constructs a new object with attributes and blocks configured for the `sr_iov_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to install the SR-IOV operator. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sr_iov_config` sub block.
+
+
+## obj node_access_config
+
+
+
+### fn node_access_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `login_user` (`string`): LoginUser is the user name used to access node machines.
+It defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_access_config` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `container_runtime` (`string`): The available runtimes that can be used to run containers in a Bare Metal User Cluster. Possible values: ["CONTAINER_RUNTIME_UNSPECIFIED", "DOCKER", "CONTAINERD"] When `null`, the `container_runtime` field will be omitted from the resulting object.
+  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range
+assigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj os_environment_config
+
+
+
+### fn os_environment_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.os_environment_config.new` constructs a new object with attributes and blocks configured for the `os_environment_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `package_repo_excluded` (`bool`): Whether the package repo should not be included when initializing
+bare metal machines.
+
+**Returns**:
+  - An attribute object that represents the `os_environment_config` sub block.
+
+
+## obj proxy
+
+
+
+### fn proxy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.
+Examples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.
+  - `uri` (`string`): Specifies the address of your proxy server.
+Examples: http://domain
+WARNING: Do not provide credentials in the format
+http://(username:password@)domain these will be rejected by the server.
+
+**Returns**:
+  - An attribute object that represents the `proxy` sub block.
+
+
+## obj security_config
+
+
+
+### fn security_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `security_config` sub block.
+
+
+## obj security_config.authorization
+
+
+
+### fn security_config.authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj security_config.authorization.admin_users
+
+
+
+### fn security_config.authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj storage
+
+
+
+### fn storage.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`
+Terraform sub block.
+
+
+
+**Args**:
+  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed
+by mounted node disks. These disks need to be formatted and mounted by the
+user, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.
+  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by
+subdirectories in a shared filesystem. These subdirectores are
+automatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `storage` sub block.
+
+
+## obj storage.lvp_node_mounts_config
+
+
+
+### fn storage.lvp_node_mounts_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_node_mounts_config` sub block.
+
+
+## obj storage.lvp_share_config
+
+
+
+### fn storage.lvp_share_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.
+  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `lvp_share_config` sub block.
+
+
+## obj storage.lvp_share_config.lvp_config
+
+
+
+### fn storage.lvp_share_config.lvp_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj upgrade_policy
+
+
+
+### fn upgrade_policy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `policy` (`string`): Specifies which upgrade policy to use. Possible values: ["SERIAL", "CONCURRENT"] When `null`, the `policy` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `upgrade_policy` sub block.
diff --git a/docs/4.x/gkeonprem_bare_metal_node_pool.md b/docs/4.x/gkeonprem_bare_metal_node_pool.md
new file mode 100644
index 00000000..72088b76
--- /dev/null
+++ b/docs/4.x/gkeonprem_bare_metal_node_pool.md
@@ -0,0 +1,417 @@
+---
+permalink: /gkeonprem_bare_metal_node_pool/
+---
+
+# gkeonprem_bare_metal_node_pool
+
+`gkeonprem_bare_metal_node_pool` represents the `google_gkeonprem_bare_metal_node_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withBareMetalCluster()`](#fn-withbaremetalcluster)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodePoolConfig()`](#fn-withnodepoolconfig)
+* [`fn withNodePoolConfigMixin()`](#fn-withnodepoolconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj node_pool_config`](#obj-node_pool_config)
+  * [`fn new()`](#fn-node_pool_confignew)
+  * [`obj node_pool_config.node_configs`](#obj-node_pool_confignode_configs)
+    * [`fn new()`](#fn-node_pool_confignode_configsnew)
+  * [`obj node_pool_config.taints`](#obj-node_pool_configtaints)
+    * [`fn new()`](#fn-node_pool_configtaintsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.new` injects a new `google_gkeonprem_bare_metal_node_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_bare_metal_node_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_node_pool` using the reference:
+
+    $._ref.google_gkeonprem_bare_metal_node_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_bare_metal_node_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.
+  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal node pool name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_node_pool`
+Terraform resource.
+
+Unlike [google.gkeonprem_bare_metal_node_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.
+  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal node pool name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_node_pool` resource into the root Terraform configuration.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withBareMetalCluster
+
+```ts
+withBareMetalCluster()
+```
+
+`google.string.withBareMetalCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the bare_metal_cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `bare_metal_cluster` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodePoolConfig
+
+```ts
+withNodePoolConfig()
+```
+
+`google.list[obj].withNodePoolConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodePoolConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.
+
+
+### fn withNodePoolConfigMixin
+
+```ts
+withNodePoolConfigMixin()
+```
+
+`google.list[obj].withNodePoolConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj node_pool_config
+
+
+
+### fn node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new](#fn-node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new](#fn-node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj node_pool_config.node_configs
+
+
+
+### fn node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj node_pool_config.taints
+
+
+
+### fn node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gkeonprem_vmware_cluster.md b/docs/4.x/gkeonprem_vmware_cluster.md
new file mode 100644
index 00000000..e3f44f27
--- /dev/null
+++ b/docs/4.x/gkeonprem_vmware_cluster.md
@@ -0,0 +1,1437 @@
+---
+permalink: /gkeonprem_vmware_cluster/
+---
+
+# gkeonprem_vmware_cluster
+
+`gkeonprem_vmware_cluster` represents the `google_gkeonprem_vmware_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdminClusterMembership()`](#fn-withadminclustermembership)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withAntiAffinityGroups()`](#fn-withantiaffinitygroups)
+* [`fn withAntiAffinityGroupsMixin()`](#fn-withantiaffinitygroupsmixin)
+* [`fn withAuthorization()`](#fn-withauthorization)
+* [`fn withAuthorizationMixin()`](#fn-withauthorizationmixin)
+* [`fn withAutoRepairConfig()`](#fn-withautorepairconfig)
+* [`fn withAutoRepairConfigMixin()`](#fn-withautorepairconfigmixin)
+* [`fn withControlPlaneNode()`](#fn-withcontrolplanenode)
+* [`fn withControlPlaneNodeMixin()`](#fn-withcontrolplanenodemixin)
+* [`fn withDataplaneV2()`](#fn-withdataplanev2)
+* [`fn withDataplaneV2Mixin()`](#fn-withdataplanev2mixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withEnableControlPlaneV2()`](#fn-withenablecontrolplanev2)
+* [`fn withLoadBalancer()`](#fn-withloadbalancer)
+* [`fn withLoadBalancerMixin()`](#fn-withloadbalancermixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withOnPremVersion()`](#fn-withonpremversion)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withStorage()`](#fn-withstorage)
+* [`fn withStorageMixin()`](#fn-withstoragemixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUpgradePolicy()`](#fn-withupgradepolicy)
+* [`fn withUpgradePolicyMixin()`](#fn-withupgradepolicymixin)
+* [`fn withVcenter()`](#fn-withvcenter)
+* [`fn withVcenterMixin()`](#fn-withvcentermixin)
+* [`fn withVmTrackingEnabled()`](#fn-withvmtrackingenabled)
+* [`obj anti_affinity_groups`](#obj-anti_affinity_groups)
+  * [`fn new()`](#fn-anti_affinity_groupsnew)
+* [`obj authorization`](#obj-authorization)
+  * [`fn new()`](#fn-authorizationnew)
+  * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
+    * [`fn new()`](#fn-authorizationadmin_usersnew)
+* [`obj auto_repair_config`](#obj-auto_repair_config)
+  * [`fn new()`](#fn-auto_repair_confignew)
+* [`obj control_plane_node`](#obj-control_plane_node)
+  * [`fn new()`](#fn-control_plane_nodenew)
+  * [`obj control_plane_node.auto_resize_config`](#obj-control_plane_nodeauto_resize_config)
+    * [`fn new()`](#fn-control_plane_nodeauto_resize_confignew)
+* [`obj dataplane_v2`](#obj-dataplane_v2)
+  * [`fn new()`](#fn-dataplane_v2new)
+* [`obj load_balancer`](#obj-load_balancer)
+  * [`fn new()`](#fn-load_balancernew)
+  * [`obj load_balancer.f5_config`](#obj-load_balancerf5_config)
+    * [`fn new()`](#fn-load_balancerf5_confignew)
+  * [`obj load_balancer.manual_lb_config`](#obj-load_balancermanual_lb_config)
+    * [`fn new()`](#fn-load_balancermanual_lb_confignew)
+  * [`obj load_balancer.metal_lb_config`](#obj-load_balancermetal_lb_config)
+    * [`fn new()`](#fn-load_balancermetal_lb_confignew)
+    * [`obj load_balancer.metal_lb_config.address_pools`](#obj-load_balancermetal_lb_configaddress_pools)
+      * [`fn new()`](#fn-load_balancermetal_lb_configaddress_poolsnew)
+  * [`obj load_balancer.vip_config`](#obj-load_balancervip_config)
+    * [`fn new()`](#fn-load_balancervip_confignew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.control_plane_v2_config`](#obj-network_configcontrol_plane_v2_config)
+    * [`fn new()`](#fn-network_configcontrol_plane_v2_confignew)
+    * [`obj network_config.control_plane_v2_config.control_plane_ip_block`](#obj-network_configcontrol_plane_v2_configcontrol_plane_ip_block)
+      * [`fn new()`](#fn-network_configcontrol_plane_v2_configcontrol_plane_ip_blocknew)
+      * [`obj network_config.control_plane_v2_config.control_plane_ip_block.ips`](#obj-network_configcontrol_plane_v2_configcontrol_plane_ip_blockips)
+        * [`fn new()`](#fn-network_configcontrol_plane_v2_configcontrol_plane_ip_blockipsnew)
+  * [`obj network_config.dhcp_ip_config`](#obj-network_configdhcp_ip_config)
+    * [`fn new()`](#fn-network_configdhcp_ip_confignew)
+  * [`obj network_config.host_config`](#obj-network_confighost_config)
+    * [`fn new()`](#fn-network_confighost_confignew)
+  * [`obj network_config.static_ip_config`](#obj-network_configstatic_ip_config)
+    * [`fn new()`](#fn-network_configstatic_ip_confignew)
+    * [`obj network_config.static_ip_config.ip_blocks`](#obj-network_configstatic_ip_configip_blocks)
+      * [`fn new()`](#fn-network_configstatic_ip_configip_blocksnew)
+      * [`obj network_config.static_ip_config.ip_blocks.ips`](#obj-network_configstatic_ip_configip_blocksips)
+        * [`fn new()`](#fn-network_configstatic_ip_configip_blocksipsnew)
+* [`obj storage`](#obj-storage)
+  * [`fn new()`](#fn-storagenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj upgrade_policy`](#obj-upgrade_policy)
+  * [`fn new()`](#fn-upgrade_policynew)
+* [`obj vcenter`](#obj-vcenter)
+  * [`fn new()`](#fn-vcenternew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.new` injects a new `google_gkeonprem_vmware_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_vmware_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_vmware_cluster` using the reference:
+
+    $._ref.google_gkeonprem_vmware_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_vmware_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.
+This is the full resource name of the admin cluster's hub membership.
+In the future, references to other resource types might be allowed if
+admin clusters are modeled as their own resources.
+  - `annotations` (`obj`): Annotations on the VMware User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The VMware cluster name.
+  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.
+  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at
+least three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.
+  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.
+  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.
+  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.
+Inherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_vmware_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_cluster`
+Terraform resource.
+
+Unlike [google.gkeonprem_vmware_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.
+This is the full resource name of the admin cluster's hub membership.
+In the future, references to other resource types might be allowed if
+admin clusters are modeled as their own resources.
+  - `annotations` (`obj`): Annotations on the VMware User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The VMware cluster name.
+  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.
+  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at
+least three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.
+  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.
+  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.
+  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.
+Inherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_cluster` resource into the root Terraform configuration.
+
+
+### fn withAdminClusterMembership
+
+```ts
+withAdminClusterMembership()
+```
+
+`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the admin_cluster_membership field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `admin_cluster_membership` field.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withAntiAffinityGroups
+
+```ts
+withAntiAffinityGroups()
+```
+
+`google.list[obj].withAntiAffinityGroups` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the anti_affinity_groups field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAntiAffinityGroupsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.
+
+
+### fn withAntiAffinityGroupsMixin
+
+```ts
+withAntiAffinityGroupsMixin()
+```
+
+`google.list[obj].withAntiAffinityGroupsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the anti_affinity_groups field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAntiAffinityGroups](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.
+
+
+### fn withAuthorization
+
+```ts
+withAuthorization()
+```
+
+`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withAuthorizationMixin
+
+```ts
+withAuthorizationMixin()
+```
+
+`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withAutoRepairConfig
+
+```ts
+withAutoRepairConfig()
+```
+
+`google.list[obj].withAutoRepairConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the auto_repair_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAutoRepairConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.
+
+
+### fn withAutoRepairConfigMixin
+
+```ts
+withAutoRepairConfigMixin()
+```
+
+`google.list[obj].withAutoRepairConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the auto_repair_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAutoRepairConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.
+
+
+### fn withControlPlaneNode
+
+```ts
+withControlPlaneNode()
+```
+
+`google.list[obj].withControlPlaneNode` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_node field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneNodeMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.
+
+
+### fn withControlPlaneNodeMixin
+
+```ts
+withControlPlaneNodeMixin()
+```
+
+`google.list[obj].withControlPlaneNodeMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_node field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneNode](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.
+
+
+### fn withDataplaneV2
+
+```ts
+withDataplaneV2()
+```
+
+`google.list[obj].withDataplaneV2` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dataplane_v2 field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDataplaneV2Mixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.
+
+
+### fn withDataplaneV2Mixin
+
+```ts
+withDataplaneV2Mixin()
+```
+
+`google.list[obj].withDataplaneV2Mixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dataplane_v2 field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDataplaneV2](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withEnableControlPlaneV2
+
+```ts
+withEnableControlPlaneV2()
+```
+
+`google.bool.withEnableControlPlaneV2` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_control_plane_v2 field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_control_plane_v2` field.
+
+
+### fn withLoadBalancer
+
+```ts
+withLoadBalancer()
+```
+
+`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLoadBalancerMixin
+
+```ts
+withLoadBalancerMixin()
+```
+
+`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withOnPremVersion
+
+```ts
+withOnPremVersion()
+```
+
+`google.string.withOnPremVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the on_prem_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `on_prem_version` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withStorage
+
+```ts
+withStorage()
+```
+
+`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withStorageMixin
+
+```ts
+withStorageMixin()
+```
+
+`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUpgradePolicy
+
+```ts
+withUpgradePolicy()
+```
+
+`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+### fn withUpgradePolicyMixin
+
+```ts
+withUpgradePolicyMixin()
+```
+
+`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+### fn withVcenter
+
+```ts
+withVcenter()
+```
+
+`google.list[obj].withVcenter` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vcenter field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVcenterMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vcenter` field.
+
+
+### fn withVcenterMixin
+
+```ts
+withVcenterMixin()
+```
+
+`google.list[obj].withVcenterMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vcenter field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVcenter](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vcenter` field.
+
+
+### fn withVmTrackingEnabled
+
+```ts
+withVmTrackingEnabled()
+```
+
+`google.bool.withVmTrackingEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the vm_tracking_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `vm_tracking_enabled` field.
+
+
+## obj anti_affinity_groups
+
+
+
+### fn anti_affinity_groups.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.anti_affinity_groups.new` constructs a new object with attributes and blocks configured for the `anti_affinity_groups`
+Terraform sub block.
+
+
+
+**Args**:
+  - `aag_config_disabled` (`bool`): Spread nodes across at least three physical hosts (requires at least three
+hosts).
+Enabled by default.
+
+**Returns**:
+  - An attribute object that represents the `anti_affinity_groups` sub block.
+
+
+## obj authorization
+
+
+
+### fn authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing
+full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj authorization.admin_users
+
+
+
+### fn authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj auto_repair_config
+
+
+
+### fn auto_repair_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.auto_repair_config.new` constructs a new object with attributes and blocks configured for the `auto_repair_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether auto repair is enabled.
+
+**Returns**:
+  - An attribute object that represents the `auto_repair_config` sub block.
+
+
+## obj control_plane_node
+
+
+
+### fn control_plane_node.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.control_plane_node.new` constructs a new object with attributes and blocks configured for the `control_plane_node`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cpus` (`number`): The number of CPUs for each admin cluster node that serve as control planes
+for this VMware User Cluster. (default: 4 CPUs) When `null`, the `cpus` field will be omitted from the resulting object.
+  - `memory` (`number`): The megabytes of memory for each admin cluster node that serves as a
+control plane for this VMware User Cluster (default: 8192 MB memory). When `null`, the `memory` field will be omitted from the resulting object.
+  - `replicas` (`number`): The number of control plane nodes for this VMware User Cluster.
+(default: 1 replica). When `null`, the `replicas` field will be omitted from the resulting object.
+  - `auto_resize_config` (`list[obj]`): AutoResizeConfig provides auto resizing configurations. When `null`, the `auto_resize_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new](#fn-control_plane_nodeauto_resize_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_node` sub block.
+
+
+## obj control_plane_node.auto_resize_config
+
+
+
+### fn control_plane_node.auto_resize_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new` constructs a new object with attributes and blocks configured for the `auto_resize_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to enable control plane node auto resizing.
+
+**Returns**:
+  - An attribute object that represents the `auto_resize_config` sub block.
+
+
+## obj dataplane_v2
+
+
+
+### fn dataplane_v2.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.dataplane_v2.new` constructs a new object with attributes and blocks configured for the `dataplane_v2`
+Terraform sub block.
+
+
+
+**Args**:
+  - `advanced_networking` (`bool`): Enable advanced networking which requires dataplane_v2_enabled to be set true. When `null`, the `advanced_networking` field will be omitted from the resulting object.
+  - `dataplane_v2_enabled` (`bool`): Enables Dataplane V2. When `null`, the `dataplane_v2_enabled` field will be omitted from the resulting object.
+  - `windows_dataplane_v2_enabled` (`bool`): Enable Dataplane V2 for clusters with Windows nodes. When `null`, the `windows_dataplane_v2_enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dataplane_v2` sub block.
+
+
+## obj load_balancer
+
+
+
+### fn load_balancer.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `f5_config` (`list[obj]`): Configuration for F5 Big IP typed load balancers. When `null`, the `f5_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.f5_config.new](#fn-load_balancerf5_confignew) constructor.
+  - `manual_lb_config` (`list[obj]`): Manually configured load balancers. When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.
+  - `metal_lb_config` (`list[obj]`): Configuration for MetalLB typed load balancers. When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.
+  - `vip_config` (`list[obj]`): The VIPs used by the load balancer. When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer` sub block.
+
+
+## obj load_balancer.f5_config
+
+
+
+### fn load_balancer.f5_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.f5_config.new` constructs a new object with attributes and blocks configured for the `f5_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The load balancer's IP address. When `null`, the `address` field will be omitted from the resulting object.
+  - `partition` (`string`): he preexisting partition to be used by the load balancer. T
+his partition is usually created for the admin cluster for example:
+'my-f5-admin-partition'. When `null`, the `partition` field will be omitted from the resulting object.
+  - `snat_pool` (`string`): The pool name. Only necessary, if using SNAT. When `null`, the `snat_pool` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `f5_config` sub block.
+
+
+## obj load_balancer.manual_lb_config
+
+
+
+### fn load_balancer.manual_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_node_port` (`number`): NodePort for control plane service. The Kubernetes API server in the admin
+cluster is implemented as a Service of type NodePort (ex. 30968). When `null`, the `control_plane_node_port` field will be omitted from the resulting object.
+  - `ingress_http_node_port` (`number`): NodePort for ingress service's http. The ingress service in the admin
+cluster is implemented as a Service of type NodePort (ex. 32527). When `null`, the `ingress_http_node_port` field will be omitted from the resulting object.
+  - `ingress_https_node_port` (`number`): NodePort for ingress service's https. The ingress service in the admin
+cluster is implemented as a Service of type NodePort (ex. 30139). When `null`, the `ingress_https_node_port` field will be omitted from the resulting object.
+  - `konnectivity_server_node_port` (`number`): NodePort for konnectivity server service running as a sidecar in each
+kube-apiserver pod (ex. 30564). When `null`, the `konnectivity_server_node_port` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `manual_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config
+
+
+
+### fn load_balancer.metal_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer
+typed services. All addresses must be routable to load balancer nodes.
+IngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `metal_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.address_pools
+
+
+
+### fn load_balancer.metal_lb_config.address_pools.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`
+Terraform sub block.
+
+
+
+**Args**:
+  - `addresses` (`list`): The addresses that are part of this pool. Each address
+must be either in the CIDR form (1.2.3.0/24) or range
+form (1.2.3.1-1.2.3.5).
+  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.
+This avoids buggy consumer devices mistakenly dropping IPv4 traffic for
+those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.
+  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.
+  - `pool` (`string`): The name of the address pool.
+
+**Returns**:
+  - An attribute object that represents the `address_pools` sub block.
+
+
+## obj load_balancer.vip_config
+
+
+
+### fn load_balancer.vip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this cluster. When `null`, the `control_plane_vip` field will be omitted from the resulting object.
+  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this cluster. When `null`, the `ingress_vip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vip_config` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges.
+Only a single range is supported. This field cannot be changed after creation.
+  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address
+from these ranges. Only a single range is supported.. This field
+cannot be changed after creation.
+  - `control_plane_v2_config` (`list[obj]`): Configuration for control plane V2 mode. When `null`, the `control_plane_v2_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new](#fn-network_configcontrol_plane_v2_confignew) constructor.
+  - `dhcp_ip_config` (`list[obj]`): Configuration settings for a DHCP IP configuration. When `null`, the `dhcp_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new](#fn-network_configdhcp_ip_confignew) constructor.
+  - `host_config` (`list[obj]`): Represents common network settings irrespective of the host's IP address. When `null`, the `host_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.host_config.new](#fn-network_confighost_confignew) constructor.
+  - `static_ip_config` (`list[obj]`): Configuration settings for a static IP configuration. When `null`, the `static_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.new](#fn-network_configstatic_ip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj network_config.control_plane_v2_config
+
+
+
+### fn network_config.control_plane_v2_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new` constructs a new object with attributes and blocks configured for the `control_plane_v2_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_ip_block` (`list[obj]`): Static IP addresses for the control plane nodes. When `null`, the `control_plane_ip_block` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new](#fn-network_confignetwork_configcontrol_plane_ip_blocknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_v2_config` sub block.
+
+
+## obj network_config.control_plane_v2_config.control_plane_ip_block
+
+
+
+### fn network_config.control_plane_v2_config.control_plane_ip_block.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new` constructs a new object with attributes and blocks configured for the `control_plane_ip_block`
+Terraform sub block.
+
+
+
+**Args**:
+  - `gateway` (`string`): The network gateway used by the VMware User Cluster. When `null`, the `gateway` field will be omitted from the resulting object.
+  - `netmask` (`string`): The netmask used by the VMware User Cluster. When `null`, the `netmask` field will be omitted from the resulting object.
+  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new](#fn-network_confignetwork_configcontrol_plane_v2_configipsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_ip_block` sub block.
+
+
+## obj network_config.control_plane_v2_config.control_plane_ip_block.ips
+
+
+
+### fn network_config.control_plane_v2_config.control_plane_ip_block.ips.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new` constructs a new object with attributes and blocks configured for the `ips`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.
+  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24). When `null`, the `ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ips` sub block.
+
+
+## obj network_config.dhcp_ip_config
+
+
+
+### fn network_config.dhcp_ip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new` constructs a new object with attributes and blocks configured for the `dhcp_ip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): enabled is a flag to mark if DHCP IP allocation is
+used for VMware user clusters.
+
+**Returns**:
+  - An attribute object that represents the `dhcp_ip_config` sub block.
+
+
+## obj network_config.host_config
+
+
+
+### fn network_config.host_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.host_config.new` constructs a new object with attributes and blocks configured for the `host_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dns_search_domains` (`list`): DNS search domains. When `null`, the `dns_search_domains` field will be omitted from the resulting object.
+  - `dns_servers` (`list`): DNS servers. When `null`, the `dns_servers` field will be omitted from the resulting object.
+  - `ntp_servers` (`list`): NTP servers. When `null`, the `ntp_servers` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `host_config` sub block.
+
+
+## obj network_config.static_ip_config
+
+
+
+### fn network_config.static_ip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.static_ip_config.new` constructs a new object with attributes and blocks configured for the `static_ip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ip_blocks` (`list[obj]`): Represents the configuration values for static IP allocation to nodes. When `null`, the `ip_blocks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new](#fn-network_confignetwork_configip_blocksnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `static_ip_config` sub block.
+
+
+## obj network_config.static_ip_config.ip_blocks
+
+
+
+### fn network_config.static_ip_config.ip_blocks.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new` constructs a new object with attributes and blocks configured for the `ip_blocks`
+Terraform sub block.
+
+
+
+**Args**:
+  - `gateway` (`string`): The network gateway used by the VMware User Cluster.
+  - `netmask` (`string`): The netmask used by the VMware User Cluster.
+  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new](#fn-network_confignetwork_configstatic_ip_configipsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ip_blocks` sub block.
+
+
+## obj network_config.static_ip_config.ip_blocks.ips
+
+
+
+### fn network_config.static_ip_config.ip_blocks.ips.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new` constructs a new object with attributes and blocks configured for the `ips`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.
+  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24).
+
+**Returns**:
+  - An attribute object that represents the `ips` sub block.
+
+
+## obj storage
+
+
+
+### fn storage.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vsphere_csi_disabled` (`bool`): Whether or not to deploy vSphere CSI components in the VMware User Cluster.
+Enabled by default.
+
+**Returns**:
+  - An attribute object that represents the `storage` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj upgrade_policy
+
+
+
+### fn upgrade_policy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_only` (`bool`): Controls whether the upgrade applies to the control plane only. When `null`, the `control_plane_only` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `upgrade_policy` sub block.
+
+
+## obj vcenter
+
+
+
+### fn vcenter.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.vcenter.new` constructs a new object with attributes and blocks configured for the `vcenter`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ca_cert_data` (`string`): Contains the vCenter CA certificate public key for SSL verification. When `null`, the `ca_cert_data` field will be omitted from the resulting object.
+  - `cluster` (`string`): The name of the vCenter cluster for the user cluster. When `null`, the `cluster` field will be omitted from the resulting object.
+  - `datacenter` (`string`): The name of the vCenter datacenter for the user cluster. When `null`, the `datacenter` field will be omitted from the resulting object.
+  - `datastore` (`string`): The name of the vCenter datastore for the user cluster. When `null`, the `datastore` field will be omitted from the resulting object.
+  - `folder` (`string`): The name of the vCenter folder for the user cluster. When `null`, the `folder` field will be omitted from the resulting object.
+  - `resource_pool` (`string`): The name of the vCenter resource pool for the user cluster. When `null`, the `resource_pool` field will be omitted from the resulting object.
+  - `storage_policy_name` (`string`): The name of the vCenter storage policy for the user cluster. When `null`, the `storage_policy_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vcenter` sub block.
diff --git a/docs/4.x/gkeonprem_vmware_node_pool.md b/docs/4.x/gkeonprem_vmware_node_pool.md
new file mode 100644
index 00000000..cc6d261c
--- /dev/null
+++ b/docs/4.x/gkeonprem_vmware_node_pool.md
@@ -0,0 +1,505 @@
+---
+permalink: /gkeonprem_vmware_node_pool/
+---
+
+# gkeonprem_vmware_node_pool
+
+`gkeonprem_vmware_node_pool` represents the `google_gkeonprem_vmware_node_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withConfig()`](#fn-withconfig)
+* [`fn withConfigMixin()`](#fn-withconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodePoolAutoscaling()`](#fn-withnodepoolautoscaling)
+* [`fn withNodePoolAutoscalingMixin()`](#fn-withnodepoolautoscalingmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVmwareCluster()`](#fn-withvmwarecluster)
+* [`obj config`](#obj-config)
+  * [`fn new()`](#fn-confignew)
+  * [`obj config.taints`](#obj-configtaints)
+    * [`fn new()`](#fn-configtaintsnew)
+  * [`obj config.vsphere_config`](#obj-configvsphere_config)
+    * [`fn new()`](#fn-configvsphere_confignew)
+    * [`obj config.vsphere_config.tags`](#obj-configvsphere_configtags)
+      * [`fn new()`](#fn-configvsphere_configtagsnew)
+* [`obj node_pool_autoscaling`](#obj-node_pool_autoscaling)
+  * [`fn new()`](#fn-node_pool_autoscalingnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.new` injects a new `google_gkeonprem_vmware_node_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_vmware_node_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_vmware_node_pool` using the reference:
+
+    $._ref.google_gkeonprem_vmware_node_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_vmware_node_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations on the node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The vmware node pool name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_cluster` (`string`): The cluster this node pool belongs to.
+  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.
+  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_vmware_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_node_pool`
+Terraform resource.
+
+Unlike [google.gkeonprem_vmware_node_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `annotations` (`obj`): Annotations on the node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The vmware node pool name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_cluster` (`string`): The cluster this node pool belongs to.
+  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.
+  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_node_pool` resource into the root Terraform configuration.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withConfig
+
+```ts
+withConfig()
+```
+
+`google.list[obj].withConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `config` field.
+
+
+### fn withConfigMixin
+
+```ts
+withConfigMixin()
+```
+
+`google.list[obj].withConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodePoolAutoscaling
+
+```ts
+withNodePoolAutoscaling()
+```
+
+`google.list[obj].withNodePoolAutoscaling` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_autoscaling field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodePoolAutoscalingMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.
+
+
+### fn withNodePoolAutoscalingMixin
+
+```ts
+withNodePoolAutoscalingMixin()
+```
+
+`google.list[obj].withNodePoolAutoscalingMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_autoscaling field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolAutoscaling](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVmwareCluster
+
+```ts
+withVmwareCluster()
+```
+
+`google.string.withVmwareCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the vmware_cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `vmware_cluster` field.
+
+
+## obj config
+
+
+
+### fn config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.config.new` constructs a new object with attributes and blocks configured for the `config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boot_disk_size_gb` (`number`): VMware disk size to be used during creation. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.
+  - `cpus` (`number`): The number of CPUs for each node in the node pool. When `null`, the `cpus` field will be omitted from the resulting object.
+  - `enable_load_balancer` (`bool`): Allow node pool traffic to be load balanced. Only works for clusters with
+MetalLB load balancers. When `null`, the `enable_load_balancer` field will be omitted from the resulting object.
+  - `image` (`string`): The OS image name in vCenter, only valid when using Windows. When `null`, the `image` field will be omitted from the resulting object.
+  - `image_type` (`string`): The OS image to be used for each node in a node pool.
+Currently 'cos', 'ubuntu', 'ubuntu_containerd' and 'windows' are supported.
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node.
+These will added in addition to any default label(s) that
+Kubernetes may apply to the node.
+In case of conflict in label keys, the applied set may differ depending on
+the Kubernetes version -- it's best to assume the behavior is undefined
+and conflicts should be avoided. When `null`, the `labels` field will be omitted from the resulting object.
+  - `memory_mb` (`number`): The megabytes of memory for each node in the node pool. When `null`, the `memory_mb` field will be omitted from the resulting object.
+  - `replicas` (`number`): The number of nodes in the node pool. When `null`, the `replicas` field will be omitted from the resulting object.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.taints.new](#fn-configtaintsnew) constructor.
+  - `vsphere_config` (`list[obj]`): Specifies the vSphere config for node pool. When `null`, the `vsphere_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.vsphere_config.new](#fn-configvsphere_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `config` sub block.
+
+
+## obj config.taints
+
+
+
+### fn config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Available taint effects. Possible values: ["EFFECT_UNSPECIFIED", "NO_SCHEDULE", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect.
+  - `value` (`string`): Value associated with the effect.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj config.vsphere_config
+
+
+
+### fn config.vsphere_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.config.vsphere_config.new` constructs a new object with attributes and blocks configured for the `vsphere_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `datastore` (`string`): The name of the vCenter datastore. Inherited from the user cluster. When `null`, the `datastore` field will be omitted from the resulting object.
+  - `host_groups` (`list`): Vsphere host groups to apply to all VMs in the node pool When `null`, the `host_groups` field will be omitted from the resulting object.
+  - `tags` (`list[obj]`): Tags to apply to VMs. When `null`, the `tags` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.vsphere_config.tags.new](#fn-configconfigtagsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vsphere_config` sub block.
+
+
+## obj config.vsphere_config.tags
+
+
+
+### fn config.vsphere_config.tags.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.config.vsphere_config.tags.new` constructs a new object with attributes and blocks configured for the `tags`
+Terraform sub block.
+
+
+
+**Args**:
+  - `category` (`string`): The Vsphere tag category. When `null`, the `category` field will be omitted from the resulting object.
+  - `tag` (`string`): The Vsphere tag name. When `null`, the `tag` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `tags` sub block.
+
+
+## obj node_pool_autoscaling
+
+
+
+### fn node_pool_autoscaling.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new` constructs a new object with attributes and blocks configured for the `node_pool_autoscaling`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_replicas` (`number`): Maximum number of replicas in the NodePool.
+  - `min_replicas` (`number`): Minimum number of replicas in the NodePool.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_autoscaling` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/healthcare_consent_store.md b/docs/4.x/healthcare_consent_store.md
index 62f167d0..f07142c4 100644
--- a/docs/4.x/healthcare_consent_store.md
+++ b/docs/4.x/healthcare_consent_store.md
@@ -71,7 +71,11 @@ bytes, and must conform to the following PCRE regular expression: '[\p{Ll}\p
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of this ConsentStore, for example:
 "consent1"
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.
@@ -115,7 +119,11 @@ bytes, and must conform to the following PCRE regular expression: '[\p{Ll}\p
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of this ConsentStore, for example:
 "consent1"
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/healthcare_dicom_store.md b/docs/4.x/healthcare_dicom_store.md
index a47281b9..21d9b904 100644
--- a/docs/4.x/healthcare_dicom_store.md
+++ b/docs/4.x/healthcare_dicom_store.md
@@ -69,7 +69,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the DicomStore.
 
 ** Changing this property may recreate the Dicom store (removing all data) **
@@ -111,7 +115,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the DicomStore.
 
 ** Changing this property may recreate the Dicom store (removing all data) **
diff --git a/docs/4.x/healthcare_fhir_store.md b/docs/4.x/healthcare_fhir_store.md
index bb3957d5..2683d404 100644
--- a/docs/4.x/healthcare_fhir_store.md
+++ b/docs/4.x/healthcare_fhir_store.md
@@ -118,7 +118,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the FhirStore.
 
 ** Changing this property may recreate the FHIR store (removing all data) **
@@ -199,7 +203,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the FhirStore.
 
 ** Changing this property may recreate the FHIR store (removing all data) **
diff --git a/docs/4.x/healthcare_hl7_v2_store.md b/docs/4.x/healthcare_hl7_v2_store.md
index 59d6d37e..39887be1 100644
--- a/docs/4.x/healthcare_hl7_v2_store.md
+++ b/docs/4.x/healthcare_hl7_v2_store.md
@@ -77,7 +77,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the Hl7V2Store.
 
 ** Changing this property may recreate the Hl7v2 store (removing all data) **
@@ -123,7 +127,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the Hl7V2Store.
 
 ** Changing this property may recreate the Hl7v2 store (removing all data) **
diff --git a/docs/4.x/iam_workforce_pool.md b/docs/4.x/iam_workforce_pool.md
index 4f5c590a..b50f32d2 100644
--- a/docs/4.x/iam_workforce_pool.md
+++ b/docs/4.x/iam_workforce_pool.md
@@ -15,6 +15,8 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAccessRestrictions()`](#fn-withaccessrestrictions)
+* [`fn withAccessRestrictionsMixin()`](#fn-withaccessrestrictionsmixin)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisabled()`](#fn-withdisabled)
 * [`fn withDisplayName()`](#fn-withdisplayname)
@@ -24,6 +26,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withWorkforcePoolId()`](#fn-withworkforcepoolid)
+* [`obj access_restrictions`](#obj-access_restrictions)
+  * [`fn new()`](#fn-access_restrictionsnew)
+  * [`obj access_restrictions.allowed_services`](#obj-access_restrictionsallowed_services)
+    * [`fn new()`](#fn-access_restrictionsallowed_servicesnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -70,6 +76,8 @@ A duration in seconds with up to nine fractional digits, ending with ''s
   - `workforce_pool_id` (`string`): The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,
 digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.
 The prefix 'gcp-' is reserved for use by Google, and may not be specified.
+  - `access_restrictions` (`list[obj]`): Configure access restrictions on the workforce pool users. This is an optional field. If specified web
+sign-in can be restricted to given set of services or programmatic sign-in can be disabled for pool users. When `null`, the `access_restrictions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.access_restrictions.new](#fn-access_restrictionsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -108,12 +116,51 @@ A duration in seconds with up to nine fractional digits, ending with ''s
   - `workforce_pool_id` (`string`): The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,
 digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.
 The prefix 'gcp-' is reserved for use by Google, and may not be specified.
+  - `access_restrictions` (`list[obj]`): Configure access restrictions on the workforce pool users. This is an optional field. If specified web
+sign-in can be restricted to given set of services or programmatic sign-in can be disabled for pool users. When `null`, the `access_restrictions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.access_restrictions.new](#fn-access_restrictionsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `iam_workforce_pool` resource into the root Terraform configuration.
 
 
+### fn withAccessRestrictions
+
+```ts
+withAccessRestrictions()
+```
+
+`google.list[obj].withAccessRestrictions` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the access_restrictions field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAccessRestrictionsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `access_restrictions` field.
+
+
+### fn withAccessRestrictionsMixin
+
+```ts
+withAccessRestrictionsMixin()
+```
+
+`google.list[obj].withAccessRestrictionsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the access_restrictions field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAccessRestrictions](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `access_restrictions` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -262,6 +309,56 @@ Terraform resource block to set or update the workforce_pool_id field.
   - `value` (`string`): The value to set for the `workforce_pool_id` field.
 
 
+## obj access_restrictions
+
+
+
+### fn access_restrictions.new
+
+```ts
+new()
+```
+
+
+`google.iam_workforce_pool.access_restrictions.new` constructs a new object with attributes and blocks configured for the `access_restrictions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disable_programmatic_signin` (`bool`): Disable programmatic sign-in by disabling token issue via the Security Token API endpoint.
+See [Security Token Service API](https://cloud.google.com/iam/docs/reference/sts/rest). When `null`, the `disable_programmatic_signin` field will be omitted from the resulting object.
+  - `allowed_services` (`list[obj]`): Services allowed for web sign-in with the workforce pool.
+If not set by default there are no restrictions. When `null`, the `allowed_services` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool.access_restrictions.allowed_services.new](#fn-access_restrictionsallowed_servicesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `access_restrictions` sub block.
+
+
+## obj access_restrictions.allowed_services
+
+
+
+### fn access_restrictions.allowed_services.new
+
+```ts
+new()
+```
+
+
+`google.iam_workforce_pool.access_restrictions.allowed_services.new` constructs a new object with attributes and blocks configured for the `allowed_services`
+Terraform sub block.
+
+
+
+**Args**:
+  - `domain` (`string`): Domain name of the service.
+Example: console.cloud.google When `null`, the `domain` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `allowed_services` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/iam_workforce_pool_provider.md b/docs/4.x/iam_workforce_pool_provider.md
index b1605363..57fe1025 100644
--- a/docs/4.x/iam_workforce_pool_provider.md
+++ b/docs/4.x/iam_workforce_pool_provider.md
@@ -526,6 +526,29 @@ Terraform sub block.
 **Args**:
   - `client_id` (`string`): The client ID. Must match the audience claim of the JWT issued by the identity provider.
   - `issuer_uri` (`string`): The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
+  - `jwks_json` (`string`): OIDC JWKs in JSON String format. For details on definition of a
+JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
+use the 'jwks_uri' from the discovery document fetched from the
+.well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric
+keys are supported. The JWK must use following format and include only
+the following fields:
+'''
+{
+  "keys": [
+    {
+          "kty": "RSA/EC",
+          "alg": "<algorithm>",
+          "use": "sig",
+          "kid": "<key-id>",
+          "n": "",
+          "e": "",
+          "x": "",
+          "y": "",
+          "crv": ""
+    }
+  ]
+}
+''' When `null`, the `jwks_json` field will be omitted from the resulting object.
   - `client_secret` (`list[obj]`): The optional client secret. Required to enable Authorization Code flow for web sign-in. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.client_secret.new](#fn-oidcclient_secretnew) constructor.
   - `web_sso_config` (`list[obj]`): Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. When `null`, the `web_sso_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.web_sso_config.new](#fn-oidcweb_sso_confignew) constructor.
 
diff --git a/docs/4.x/iam_workload_identity_pool_provider.md b/docs/4.x/iam_workload_identity_pool_provider.md
index 32fef121..c52d260c 100644
--- a/docs/4.x/iam_workload_identity_pool_provider.md
+++ b/docs/4.x/iam_workload_identity_pool_provider.md
@@ -25,6 +25,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withOidc()`](#fn-withoidc)
 * [`fn withOidcMixin()`](#fn-withoidcmixin)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withSaml()`](#fn-withsaml)
+* [`fn withSamlMixin()`](#fn-withsamlmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withWorkloadIdentityPoolId()`](#fn-withworkloadidentitypoolid)
@@ -33,6 +35,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-awsnew)
 * [`obj oidc`](#obj-oidc)
   * [`fn new()`](#fn-oidcnew)
+* [`obj saml`](#obj-saml)
+  * [`fn new()`](#fn-samlnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -155,8 +159,9 @@ value should be 4-32 characters, and may contain the characters [a-z0-9-]. The p
   - `workload_identity_pool_provider_id` (`string`): The ID for the provider, which becomes the final component of the resource name. This
 value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
 'gcp-' is reserved for use by Google, and may not be specified.
-  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.
-  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.
+  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc or saml. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.
+  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws or saml. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.
+  - `saml` (`list[obj]`): An SAML 2.0 identity provider. Not compatible with the property oidc or aws. When `null`, the `saml` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.saml.new](#fn-samlnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -271,8 +276,9 @@ value should be 4-32 characters, and may contain the characters [a-z0-9-]. The p
   - `workload_identity_pool_provider_id` (`string`): The ID for the provider, which becomes the final component of the resource name. This
 value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
 'gcp-' is reserved for use by Google, and may not be specified.
-  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.
-  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.
+  - `aws` (`list[obj]`): An Amazon Web Services identity provider. Not compatible with the property oidc or saml. When `null`, the `aws` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.aws.new](#fn-awsnew) constructor.
+  - `oidc` (`list[obj]`): An OpenId Connect 1.0 identity provider. Not compatible with the property aws or saml. When `null`, the `oidc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.oidc.new](#fn-oidcnew) constructor.
+  - `saml` (`list[obj]`): An SAML 2.0 identity provider. Not compatible with the property oidc or aws. When `null`, the `saml` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.saml.new](#fn-samlnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workload_identity_pool_provider.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -449,6 +455,43 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withSaml
+
+```ts
+withSaml()
+```
+
+`google.list[obj].withSaml` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the saml field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSamlMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `saml` field.
+
+
+### fn withSamlMixin
+
+```ts
+withSamlMixin()
+```
+
+`google.list[obj].withSamlMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the saml field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSaml](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `saml` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -598,6 +641,29 @@ the following fields:
   - An attribute object that represents the `oidc` sub block.
 
 
+## obj saml
+
+
+
+### fn saml.new
+
+```ts
+new()
+```
+
+
+`google.iam_workload_identity_pool_provider.saml.new` constructs a new object with attributes and blocks configured for the `saml`
+Terraform sub block.
+
+
+
+**Args**:
+  - `idp_metadata_xml` (`string`): SAML Identity provider configuration metadata xml doc.
+
+**Returns**:
+  - An attribute object that represents the `saml` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/identity_platform_config.md b/docs/4.x/identity_platform_config.md
index 3d15dacd..bcb2b3b2 100644
--- a/docs/4.x/identity_platform_config.md
+++ b/docs/4.x/identity_platform_config.md
@@ -24,6 +24,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withQuotaMixin()`](#fn-withquotamixin)
 * [`fn withSignIn()`](#fn-withsignin)
 * [`fn withSignInMixin()`](#fn-withsigninmixin)
+* [`fn withSmsRegionConfig()`](#fn-withsmsregionconfig)
+* [`fn withSmsRegionConfigMixin()`](#fn-withsmsregionconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj blocking_functions`](#obj-blocking_functions)
@@ -44,6 +46,12 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-sign_inemailnew)
   * [`obj sign_in.phone_number`](#obj-sign_inphone_number)
     * [`fn new()`](#fn-sign_inphone_numbernew)
+* [`obj sms_region_config`](#obj-sms_region_config)
+  * [`fn new()`](#fn-sms_region_confignew)
+  * [`obj sms_region_config.allow_by_default`](#obj-sms_region_configallow_by_default)
+    * [`fn new()`](#fn-sms_region_configallow_by_defaultnew)
+  * [`obj sms_region_config.allowlist_only`](#obj-sms_region_configallowlist_only)
+    * [`fn new()`](#fn-sms_region_configallowlist_onlynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -82,6 +90,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.
   - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.
   - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.
+  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -112,6 +121,7 @@ injecting into a complete block.
   - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.
   - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.
   - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.
+  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -277,6 +287,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `sign_in` field.
 
 
+### fn withSmsRegionConfig
+
+```ts
+withSmsRegionConfig()
+```
+
+`google.list[obj].withSmsRegionConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the sms_region_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSmsRegionConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.
+
+
+### fn withSmsRegionConfigMixin
+
+```ts
+withSmsRegionConfigMixin()
+```
+
+`google.list[obj].withSmsRegionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the sms_region_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSmsRegionConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -533,6 +580,76 @@ Terraform sub block.
   - An attribute object that represents the `phone_number` sub block.
 
 
+## obj sms_region_config
+
+
+
+### fn sms_region_config.new
+
+```ts
+new()
+```
+
+
+`google.identity_platform_config.sms_region_config.new` constructs a new object with attributes and blocks configured for the `sms_region_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allow_by_default` (`list[obj]`): A policy of allowing SMS to every region by default and adding disallowed regions to a disallow list. When `null`, the `allow_by_default` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allow_by_default.new](#fn-sms_region_configallow_by_defaultnew) constructor.
+  - `allowlist_only` (`list[obj]`): A policy of only allowing regions by explicitly adding them to an allowlist. When `null`, the `allowlist_only` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allowlist_only.new](#fn-sms_region_configallowlist_onlynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `sms_region_config` sub block.
+
+
+## obj sms_region_config.allow_by_default
+
+
+
+### fn sms_region_config.allow_by_default.new
+
+```ts
+new()
+```
+
+
+`google.identity_platform_config.sms_region_config.allow_by_default.new` constructs a new object with attributes and blocks configured for the `allow_by_default`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disallowed_regions` (`list`): Two letter unicode region codes to disallow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `disallowed_regions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `allow_by_default` sub block.
+
+
+## obj sms_region_config.allowlist_only
+
+
+
+### fn sms_region_config.allowlist_only.new
+
+```ts
+new()
+```
+
+
+`google.identity_platform_config.sms_region_config.allowlist_only.new` constructs a new object with attributes and blocks configured for the `allowlist_only`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allowed_regions` (`list`): Two letter unicode region codes to allow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `allowed_regions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `allowlist_only` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/integration_connectors_connection.md b/docs/4.x/integration_connectors_connection.md
new file mode 100644
index 00000000..f4e6e125
--- /dev/null
+++ b/docs/4.x/integration_connectors_connection.md
@@ -0,0 +1,1839 @@
+---
+permalink: /integration_connectors_connection/
+---
+
+# integration_connectors_connection
+
+`integration_connectors_connection` represents the `google_integration_connectors_connection` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAuthConfig()`](#fn-withauthconfig)
+* [`fn withAuthConfigMixin()`](#fn-withauthconfigmixin)
+* [`fn withConfigVariable()`](#fn-withconfigvariable)
+* [`fn withConfigVariableMixin()`](#fn-withconfigvariablemixin)
+* [`fn withConnectorVersion()`](#fn-withconnectorversion)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDestinationConfig()`](#fn-withdestinationconfig)
+* [`fn withDestinationConfigMixin()`](#fn-withdestinationconfigmixin)
+* [`fn withEventingConfig()`](#fn-witheventingconfig)
+* [`fn withEventingConfigMixin()`](#fn-witheventingconfigmixin)
+* [`fn withEventingEnablementType()`](#fn-witheventingenablementtype)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withLockConfig()`](#fn-withlockconfig)
+* [`fn withLockConfigMixin()`](#fn-withlockconfigmixin)
+* [`fn withLogConfig()`](#fn-withlogconfig)
+* [`fn withLogConfigMixin()`](#fn-withlogconfigmixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withServiceAccount()`](#fn-withserviceaccount)
+* [`fn withSslConfig()`](#fn-withsslconfig)
+* [`fn withSslConfigMixin()`](#fn-withsslconfigmixin)
+* [`fn withSuspended()`](#fn-withsuspended)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj auth_config`](#obj-auth_config)
+  * [`fn new()`](#fn-auth_confignew)
+  * [`obj auth_config.additional_variable`](#obj-auth_configadditional_variable)
+    * [`fn new()`](#fn-auth_configadditional_variablenew)
+    * [`obj auth_config.additional_variable.encryption_key_value`](#obj-auth_configadditional_variableencryption_key_value)
+      * [`fn new()`](#fn-auth_configadditional_variableencryption_key_valuenew)
+    * [`obj auth_config.additional_variable.secret_value`](#obj-auth_configadditional_variablesecret_value)
+      * [`fn new()`](#fn-auth_configadditional_variablesecret_valuenew)
+  * [`obj auth_config.oauth2_auth_code_flow`](#obj-auth_configoauth2_auth_code_flow)
+    * [`fn new()`](#fn-auth_configoauth2_auth_code_flownew)
+    * [`obj auth_config.oauth2_auth_code_flow.client_secret`](#obj-auth_configoauth2_auth_code_flowclient_secret)
+      * [`fn new()`](#fn-auth_configoauth2_auth_code_flowclient_secretnew)
+  * [`obj auth_config.oauth2_client_credentials`](#obj-auth_configoauth2_client_credentials)
+    * [`fn new()`](#fn-auth_configoauth2_client_credentialsnew)
+    * [`obj auth_config.oauth2_client_credentials.client_secret`](#obj-auth_configoauth2_client_credentialsclient_secret)
+      * [`fn new()`](#fn-auth_configoauth2_client_credentialsclient_secretnew)
+  * [`obj auth_config.oauth2_jwt_bearer`](#obj-auth_configoauth2_jwt_bearer)
+    * [`fn new()`](#fn-auth_configoauth2_jwt_bearernew)
+    * [`obj auth_config.oauth2_jwt_bearer.client_key`](#obj-auth_configoauth2_jwt_bearerclient_key)
+      * [`fn new()`](#fn-auth_configoauth2_jwt_bearerclient_keynew)
+    * [`obj auth_config.oauth2_jwt_bearer.jwt_claims`](#obj-auth_configoauth2_jwt_bearerjwt_claims)
+      * [`fn new()`](#fn-auth_configoauth2_jwt_bearerjwt_claimsnew)
+  * [`obj auth_config.ssh_public_key`](#obj-auth_configssh_public_key)
+    * [`fn new()`](#fn-auth_configssh_public_keynew)
+    * [`obj auth_config.ssh_public_key.ssh_client_cert`](#obj-auth_configssh_public_keyssh_client_cert)
+      * [`fn new()`](#fn-auth_configssh_public_keyssh_client_certnew)
+    * [`obj auth_config.ssh_public_key.ssh_client_cert_pass`](#obj-auth_configssh_public_keyssh_client_cert_pass)
+      * [`fn new()`](#fn-auth_configssh_public_keyssh_client_cert_passnew)
+  * [`obj auth_config.user_password`](#obj-auth_configuser_password)
+    * [`fn new()`](#fn-auth_configuser_passwordnew)
+    * [`obj auth_config.user_password.password`](#obj-auth_configuser_passwordpassword)
+      * [`fn new()`](#fn-auth_configuser_passwordpasswordnew)
+* [`obj config_variable`](#obj-config_variable)
+  * [`fn new()`](#fn-config_variablenew)
+  * [`obj config_variable.encryption_key_value`](#obj-config_variableencryption_key_value)
+    * [`fn new()`](#fn-config_variableencryption_key_valuenew)
+  * [`obj config_variable.secret_value`](#obj-config_variablesecret_value)
+    * [`fn new()`](#fn-config_variablesecret_valuenew)
+* [`obj destination_config`](#obj-destination_config)
+  * [`fn new()`](#fn-destination_confignew)
+  * [`obj destination_config.destination`](#obj-destination_configdestination)
+    * [`fn new()`](#fn-destination_configdestinationnew)
+* [`obj eventing_config`](#obj-eventing_config)
+  * [`fn new()`](#fn-eventing_confignew)
+  * [`obj eventing_config.additional_variable`](#obj-eventing_configadditional_variable)
+    * [`fn new()`](#fn-eventing_configadditional_variablenew)
+    * [`obj eventing_config.additional_variable.encryption_key_value`](#obj-eventing_configadditional_variableencryption_key_value)
+      * [`fn new()`](#fn-eventing_configadditional_variableencryption_key_valuenew)
+    * [`obj eventing_config.additional_variable.secret_value`](#obj-eventing_configadditional_variablesecret_value)
+      * [`fn new()`](#fn-eventing_configadditional_variablesecret_valuenew)
+  * [`obj eventing_config.auth_config`](#obj-eventing_configauth_config)
+    * [`fn new()`](#fn-eventing_configauth_confignew)
+    * [`obj eventing_config.auth_config.additional_variable`](#obj-eventing_configauth_configadditional_variable)
+      * [`fn new()`](#fn-eventing_configauth_configadditional_variablenew)
+      * [`obj eventing_config.auth_config.additional_variable.encryption_key_value`](#obj-eventing_configauth_configadditional_variableencryption_key_value)
+        * [`fn new()`](#fn-eventing_configauth_configadditional_variableencryption_key_valuenew)
+      * [`obj eventing_config.auth_config.additional_variable.secret_value`](#obj-eventing_configauth_configadditional_variablesecret_value)
+        * [`fn new()`](#fn-eventing_configauth_configadditional_variablesecret_valuenew)
+    * [`obj eventing_config.auth_config.user_password`](#obj-eventing_configauth_configuser_password)
+      * [`fn new()`](#fn-eventing_configauth_configuser_passwordnew)
+      * [`obj eventing_config.auth_config.user_password.password`](#obj-eventing_configauth_configuser_passwordpassword)
+        * [`fn new()`](#fn-eventing_configauth_configuser_passwordpasswordnew)
+  * [`obj eventing_config.registration_destination_config`](#obj-eventing_configregistration_destination_config)
+    * [`fn new()`](#fn-eventing_configregistration_destination_confignew)
+    * [`obj eventing_config.registration_destination_config.destination`](#obj-eventing_configregistration_destination_configdestination)
+      * [`fn new()`](#fn-eventing_configregistration_destination_configdestinationnew)
+* [`obj lock_config`](#obj-lock_config)
+  * [`fn new()`](#fn-lock_confignew)
+* [`obj log_config`](#obj-log_config)
+  * [`fn new()`](#fn-log_confignew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj ssl_config`](#obj-ssl_config)
+  * [`fn new()`](#fn-ssl_confignew)
+  * [`obj ssl_config.additional_variable`](#obj-ssl_configadditional_variable)
+    * [`fn new()`](#fn-ssl_configadditional_variablenew)
+    * [`obj ssl_config.additional_variable.encryption_key_value`](#obj-ssl_configadditional_variableencryption_key_value)
+      * [`fn new()`](#fn-ssl_configadditional_variableencryption_key_valuenew)
+    * [`obj ssl_config.additional_variable.secret_value`](#obj-ssl_configadditional_variablesecret_value)
+      * [`fn new()`](#fn-ssl_configadditional_variablesecret_valuenew)
+  * [`obj ssl_config.client_certificate`](#obj-ssl_configclient_certificate)
+    * [`fn new()`](#fn-ssl_configclient_certificatenew)
+  * [`obj ssl_config.client_private_key`](#obj-ssl_configclient_private_key)
+    * [`fn new()`](#fn-ssl_configclient_private_keynew)
+  * [`obj ssl_config.client_private_key_pass`](#obj-ssl_configclient_private_key_pass)
+    * [`fn new()`](#fn-ssl_configclient_private_key_passnew)
+  * [`obj ssl_config.private_server_certificate`](#obj-ssl_configprivate_server_certificate)
+    * [`fn new()`](#fn-ssl_configprivate_server_certificatenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.new` injects a new `google_integration_connectors_connection` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.integration_connectors_connection.new('some_id')
+
+You can get the reference to the `id` field of the created `google.integration_connectors_connection` using the reference:
+
+    $._ref.google_integration_connectors_connection.some_id.get('id')
+
+This is the same as directly entering `"${ google_integration_connectors_connection.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `connector_version` (`string`): connectorVersion of the Connector.
+  - `description` (`string`): An arbitrary description for the Conection. When `null`, the `description` field will be omitted from the resulting object.
+  - `eventing_enablement_type` (`string`): Eventing enablement type. Will be nil if eventing is not enabled. Possible values: ["EVENTING_AND_CONNECTION", "ONLY_EVENTING"] When `null`, the `eventing_enablement_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location in which Connection needs to be created.
+  - `name` (`string`): Name of Connection needs to be created.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `service_account` (`string`): Service account needed for runtime plane to access Google Cloud resources. When `null`, the `service_account` field will be omitted from the resulting object.
+  - `suspended` (`bool`): Suspended indicates if a user has suspended a connection or not. When `null`, the `suspended` field will be omitted from the resulting object.
+  - `auth_config` (`list[obj]`): authConfig for the connection. When `null`, the `auth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.new](#fn-auth_confignew) constructor.
+  - `config_variable` (`list[obj]`): Config Variables for the connection. When `null`, the `config_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.new](#fn-config_variablenew) constructor.
+  - `destination_config` (`list[obj]`): Define the Connectors target endpoint. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.destination_config.new](#fn-destination_confignew) constructor.
+  - `eventing_config` (`list[obj]`): Eventing Configuration of a connection When `null`, the `eventing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.new](#fn-eventing_confignew) constructor.
+  - `lock_config` (`list[obj]`): Determines whether or no a connection is locked. If locked, a reason must be specified. When `null`, the `lock_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.lock_config.new](#fn-lock_confignew) constructor.
+  - `log_config` (`list[obj]`): Log configuration for the connection. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.log_config.new](#fn-log_confignew) constructor.
+  - `node_config` (`list[obj]`): Node configuration for the connection. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.node_config.new](#fn-node_confignew) constructor.
+  - `ssl_config` (`list[obj]`): SSL Configuration of a connection When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.new](#fn-ssl_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.integration_connectors_connection.newAttrs` constructs a new object with attributes and blocks configured for the `integration_connectors_connection`
+Terraform resource.
+
+Unlike [google.integration_connectors_connection.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `connector_version` (`string`): connectorVersion of the Connector.
+  - `description` (`string`): An arbitrary description for the Conection. When `null`, the `description` field will be omitted from the resulting object.
+  - `eventing_enablement_type` (`string`): Eventing enablement type. Will be nil if eventing is not enabled. Possible values: ["EVENTING_AND_CONNECTION", "ONLY_EVENTING"] When `null`, the `eventing_enablement_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location in which Connection needs to be created.
+  - `name` (`string`): Name of Connection needs to be created.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `service_account` (`string`): Service account needed for runtime plane to access Google Cloud resources. When `null`, the `service_account` field will be omitted from the resulting object.
+  - `suspended` (`bool`): Suspended indicates if a user has suspended a connection or not. When `null`, the `suspended` field will be omitted from the resulting object.
+  - `auth_config` (`list[obj]`): authConfig for the connection. When `null`, the `auth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.new](#fn-auth_confignew) constructor.
+  - `config_variable` (`list[obj]`): Config Variables for the connection. When `null`, the `config_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.new](#fn-config_variablenew) constructor.
+  - `destination_config` (`list[obj]`): Define the Connectors target endpoint. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.destination_config.new](#fn-destination_confignew) constructor.
+  - `eventing_config` (`list[obj]`): Eventing Configuration of a connection When `null`, the `eventing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.new](#fn-eventing_confignew) constructor.
+  - `lock_config` (`list[obj]`): Determines whether or no a connection is locked. If locked, a reason must be specified. When `null`, the `lock_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.lock_config.new](#fn-lock_confignew) constructor.
+  - `log_config` (`list[obj]`): Log configuration for the connection. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.log_config.new](#fn-log_confignew) constructor.
+  - `node_config` (`list[obj]`): Node configuration for the connection. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.node_config.new](#fn-node_confignew) constructor.
+  - `ssl_config` (`list[obj]`): SSL Configuration of a connection When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.new](#fn-ssl_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `integration_connectors_connection` resource into the root Terraform configuration.
+
+
+### fn withAuthConfig
+
+```ts
+withAuthConfig()
+```
+
+`google.list[obj].withAuthConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the auth_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAuthConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `auth_config` field.
+
+
+### fn withAuthConfigMixin
+
+```ts
+withAuthConfigMixin()
+```
+
+`google.list[obj].withAuthConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the auth_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAuthConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `auth_config` field.
+
+
+### fn withConfigVariable
+
+```ts
+withConfigVariable()
+```
+
+`google.list[obj].withConfigVariable` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the config_variable field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConfigVariableMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `config_variable` field.
+
+
+### fn withConfigVariableMixin
+
+```ts
+withConfigVariableMixin()
+```
+
+`google.list[obj].withConfigVariableMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the config_variable field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withConfigVariable](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `config_variable` field.
+
+
+### fn withConnectorVersion
+
+```ts
+withConnectorVersion()
+```
+
+`google.string.withConnectorVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the connector_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `connector_version` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDestinationConfig
+
+```ts
+withDestinationConfig()
+```
+
+`google.list[obj].withDestinationConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the destination_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDestinationConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `destination_config` field.
+
+
+### fn withDestinationConfigMixin
+
+```ts
+withDestinationConfigMixin()
+```
+
+`google.list[obj].withDestinationConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the destination_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDestinationConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `destination_config` field.
+
+
+### fn withEventingConfig
+
+```ts
+withEventingConfig()
+```
+
+`google.list[obj].withEventingConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the eventing_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withEventingConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `eventing_config` field.
+
+
+### fn withEventingConfigMixin
+
+```ts
+withEventingConfigMixin()
+```
+
+`google.list[obj].withEventingConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the eventing_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withEventingConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `eventing_config` field.
+
+
+### fn withEventingEnablementType
+
+```ts
+withEventingEnablementType()
+```
+
+`google.string.withEventingEnablementType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the eventing_enablement_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `eventing_enablement_type` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withLockConfig
+
+```ts
+withLockConfig()
+```
+
+`google.list[obj].withLockConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the lock_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLockConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `lock_config` field.
+
+
+### fn withLockConfigMixin
+
+```ts
+withLockConfigMixin()
+```
+
+`google.list[obj].withLockConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the lock_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLockConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `lock_config` field.
+
+
+### fn withLogConfig
+
+```ts
+withLogConfig()
+```
+
+`google.list[obj].withLogConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the log_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLogConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `log_config` field.
+
+
+### fn withLogConfigMixin
+
+```ts
+withLogConfigMixin()
+```
+
+`google.list[obj].withLogConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the log_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLogConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `log_config` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withServiceAccount
+
+```ts
+withServiceAccount()
+```
+
+`google.string.withServiceAccount` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the service_account field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `service_account` field.
+
+
+### fn withSslConfig
+
+```ts
+withSslConfig()
+```
+
+`google.list[obj].withSslConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ssl_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSslConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ssl_config` field.
+
+
+### fn withSslConfigMixin
+
+```ts
+withSslConfigMixin()
+```
+
+`google.list[obj].withSslConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ssl_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSslConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ssl_config` field.
+
+
+### fn withSuspended
+
+```ts
+withSuspended()
+```
+
+`google.bool.withSuspended` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the suspended field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `suspended` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj auth_config
+
+
+
+### fn auth_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.new` constructs a new object with attributes and blocks configured for the `auth_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auth_key` (`string`): The type of authentication configured. When `null`, the `auth_key` field will be omitted from the resulting object.
+  - `auth_type` (`string`): authType of the Connection Possible values: ["USER_PASSWORD", "OAUTH2_JWT_BEARER", "OAUTH2_CLIENT_CREDENTIALS", "SSH_PUBLIC_KEY", "OAUTH2_AUTH_CODE_FLOW"]
+  - `additional_variable` (`list[obj]`): List containing additional auth configs. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.additional_variable.new](#fn-auth_configadditional_variablenew) constructor.
+  - `oauth2_auth_code_flow` (`list[obj]`): Parameters to support Oauth 2.0 Auth Code Grant Authentication. When `null`, the `oauth2_auth_code_flow` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.new](#fn-auth_configoauth2_auth_code_flownew) constructor.
+  - `oauth2_client_credentials` (`list[obj]`): OAuth3 Client Credentials for Authentication. When `null`, the `oauth2_client_credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_client_credentials.new](#fn-auth_configoauth2_client_credentialsnew) constructor.
+  - `oauth2_jwt_bearer` (`list[obj]`): OAuth2 JWT Bearer for Authentication. When `null`, the `oauth2_jwt_bearer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.new](#fn-auth_configoauth2_jwt_bearernew) constructor.
+  - `ssh_public_key` (`list[obj]`): SSH Public Key for Authentication. When `null`, the `ssh_public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.ssh_public_key.new](#fn-auth_configssh_public_keynew) constructor.
+  - `user_password` (`list[obj]`): User password for Authentication. When `null`, the `user_password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.user_password.new](#fn-auth_configuser_passwordnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `auth_config` sub block.
+
+
+## obj auth_config.additional_variable
+
+
+
+### fn auth_config.additional_variable.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `key` (`string`): Key for the configVariable
+  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable. When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.additional_variable.encryption_key_value.new](#fn-auth_configauth_configencryption_key_valuenew) constructor.
+  - `secret_value` (`list[obj]`): Secret value of configVariable. When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.additional_variable.secret_value.new](#fn-auth_configauth_configsecret_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `additional_variable` sub block.
+
+
+## obj auth_config.additional_variable.encryption_key_value
+
+
+
+### fn auth_config.additional_variable.encryption_key_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected
+format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+Will be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"]
+
+**Returns**:
+  - An attribute object that represents the `encryption_key_value` sub block.
+
+
+## obj auth_config.additional_variable.secret_value
+
+
+
+### fn auth_config.additional_variable.secret_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `secret_value` sub block.
+
+
+## obj auth_config.oauth2_auth_code_flow
+
+
+
+### fn auth_config.oauth2_auth_code_flow.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.new` constructs a new object with attributes and blocks configured for the `oauth2_auth_code_flow`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auth_uri` (`string`): Auth URL for Authorization Code Flow. When `null`, the `auth_uri` field will be omitted from the resulting object.
+  - `client_id` (`string`): Client ID for user-provided OAuth app. When `null`, the `client_id` field will be omitted from the resulting object.
+  - `enable_pkce` (`bool`): Whether to enable PKCE when the user performs the auth code flow. When `null`, the `enable_pkce` field will be omitted from the resulting object.
+  - `scopes` (`list`): Scopes the connection will request when the user performs the auth code flow. When `null`, the `scopes` field will be omitted from the resulting object.
+  - `client_secret` (`list[obj]`): Client secret for user-provided OAuth app. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.client_secret.new](#fn-auth_configauth_configclient_secretnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `oauth2_auth_code_flow` sub block.
+
+
+## obj auth_config.oauth2_auth_code_flow.client_secret
+
+
+
+### fn auth_config.oauth2_auth_code_flow.client_secret.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_auth_code_flow.client_secret.new` constructs a new object with attributes and blocks configured for the `client_secret`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `client_secret` sub block.
+
+
+## obj auth_config.oauth2_client_credentials
+
+
+
+### fn auth_config.oauth2_client_credentials.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_client_credentials.new` constructs a new object with attributes and blocks configured for the `oauth2_client_credentials`
+Terraform sub block.
+
+
+
+**Args**:
+  - `client_id` (`string`): Secret version of Password for Authentication.
+  - `client_secret` (`list[obj]`): Secret version reference containing the client secret. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_client_credentials.client_secret.new](#fn-auth_configauth_configclient_secretnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `oauth2_client_credentials` sub block.
+
+
+## obj auth_config.oauth2_client_credentials.client_secret
+
+
+
+### fn auth_config.oauth2_client_credentials.client_secret.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_client_credentials.client_secret.new` constructs a new object with attributes and blocks configured for the `client_secret`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `client_secret` sub block.
+
+
+## obj auth_config.oauth2_jwt_bearer
+
+
+
+### fn auth_config.oauth2_jwt_bearer.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.new` constructs a new object with attributes and blocks configured for the `oauth2_jwt_bearer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `client_key` (`list[obj]`): Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate.
+This private key will be used to sign JWTs used for the jwt-bearer authorization grant.
+Specified in the form as: projects/*/secrets/*/versions/*. When `null`, the `client_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.client_key.new](#fn-auth_configauth_configclient_keynew) constructor.
+  - `jwt_claims` (`list[obj]`): JwtClaims providers fields to generate the token. When `null`, the `jwt_claims` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.jwt_claims.new](#fn-auth_configauth_configjwt_claimsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `oauth2_jwt_bearer` sub block.
+
+
+## obj auth_config.oauth2_jwt_bearer.client_key
+
+
+
+### fn auth_config.oauth2_jwt_bearer.client_key.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.client_key.new` constructs a new object with attributes and blocks configured for the `client_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `client_key` sub block.
+
+
+## obj auth_config.oauth2_jwt_bearer.jwt_claims
+
+
+
+### fn auth_config.oauth2_jwt_bearer.jwt_claims.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.oauth2_jwt_bearer.jwt_claims.new` constructs a new object with attributes and blocks configured for the `jwt_claims`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audience` (`string`): Value for the "aud" claim. When `null`, the `audience` field will be omitted from the resulting object.
+  - `issuer` (`string`): Value for the "iss" claim. When `null`, the `issuer` field will be omitted from the resulting object.
+  - `subject` (`string`): Value for the "sub" claim. When `null`, the `subject` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `jwt_claims` sub block.
+
+
+## obj auth_config.ssh_public_key
+
+
+
+### fn auth_config.ssh_public_key.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.ssh_public_key.new` constructs a new object with attributes and blocks configured for the `ssh_public_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cert_type` (`string`): Format of SSH Client cert. When `null`, the `cert_type` field will be omitted from the resulting object.
+  - `username` (`string`): The user account used to authenticate.
+  - `ssh_client_cert` (`list[obj]`): SSH Client Cert. It should contain both public and private key. When `null`, the `ssh_client_cert` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert.new](#fn-auth_configauth_configssh_client_certnew) constructor.
+  - `ssh_client_cert_pass` (`list[obj]`): Password (passphrase) for ssh client certificate if it has one. When `null`, the `ssh_client_cert_pass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert_pass.new](#fn-auth_configauth_configssh_client_cert_passnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ssh_public_key` sub block.
+
+
+## obj auth_config.ssh_public_key.ssh_client_cert
+
+
+
+### fn auth_config.ssh_public_key.ssh_client_cert.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert.new` constructs a new object with attributes and blocks configured for the `ssh_client_cert`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `ssh_client_cert` sub block.
+
+
+## obj auth_config.ssh_public_key.ssh_client_cert_pass
+
+
+
+### fn auth_config.ssh_public_key.ssh_client_cert_pass.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.ssh_public_key.ssh_client_cert_pass.new` constructs a new object with attributes and blocks configured for the `ssh_client_cert_pass`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `ssh_client_cert_pass` sub block.
+
+
+## obj auth_config.user_password
+
+
+
+### fn auth_config.user_password.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.user_password.new` constructs a new object with attributes and blocks configured for the `user_password`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): Username for Authentication.
+  - `password` (`list[obj]`): Password for Authentication. When `null`, the `password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.auth_config.user_password.password.new](#fn-auth_configauth_configpasswordnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `user_password` sub block.
+
+
+## obj auth_config.user_password.password
+
+
+
+### fn auth_config.user_password.password.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.auth_config.user_password.password.new` constructs a new object with attributes and blocks configured for the `password`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `password` sub block.
+
+
+## obj config_variable
+
+
+
+### fn config_variable.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.config_variable.new` constructs a new object with attributes and blocks configured for the `config_variable`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): Boolean Value of configVariable When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `integer_value` (`number`): Integer Value of configVariable When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `key` (`string`): Key for the configVariable
+  - `string_value` (`string`): String Value of configVariabley When `null`, the `string_value` field will be omitted from the resulting object.
+  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable. When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.encryption_key_value.new](#fn-config_variableencryption_key_valuenew) constructor.
+  - `secret_value` (`list[obj]`): Secret value of configVariable. When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.config_variable.secret_value.new](#fn-config_variablesecret_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `config_variable` sub block.
+
+
+## obj config_variable.encryption_key_value
+
+
+
+### fn config_variable.encryption_key_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.config_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected
+format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+Will be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"]
+
+**Returns**:
+  - An attribute object that represents the `encryption_key_value` sub block.
+
+
+## obj config_variable.secret_value
+
+
+
+### fn config_variable.secret_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.config_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `secret_value` sub block.
+
+
+## obj destination_config
+
+
+
+### fn destination_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.destination_config.new` constructs a new object with attributes and blocks configured for the `destination_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): The key is the destination identifier that is supported by the Connector.
+  - `destination` (`list[obj]`): The destinations for the key. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.destination_config.destination.new](#fn-destination_configdestinationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `destination_config` sub block.
+
+
+## obj destination_config.destination
+
+
+
+### fn destination_config.destination.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.destination_config.destination.new` constructs a new object with attributes and blocks configured for the `destination`
+Terraform sub block.
+
+
+
+**Args**:
+  - `host` (`string`): For publicly routable host. When `null`, the `host` field will be omitted from the resulting object.
+  - `port` (`number`): The port is the target port number that is accepted by the destination. When `null`, the `port` field will be omitted from the resulting object.
+  - `service_attachment` (`string`): PSC service attachments. Format: projects/*/regions/*/serviceAttachments/* When `null`, the `service_attachment` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `destination` sub block.
+
+
+## obj eventing_config
+
+
+
+### fn eventing_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.new` constructs a new object with attributes and blocks configured for the `eventing_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enrichment_enabled` (`bool`): Enrichment Enabled. When `null`, the `enrichment_enabled` field will be omitted from the resulting object.
+  - `additional_variable` (`list[obj]`): List containing additional auth configs. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.additional_variable.new](#fn-eventing_configadditional_variablenew) constructor.
+  - `auth_config` (`list[obj]`): authConfig for Eventing Configuration. When `null`, the `auth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.new](#fn-eventing_configauth_confignew) constructor.
+  - `registration_destination_config` (`list[obj]`): registrationDestinationConfig When `null`, the `registration_destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.registration_destination_config.new](#fn-eventing_configregistration_destination_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `eventing_config` sub block.
+
+
+## obj eventing_config.additional_variable
+
+
+
+### fn eventing_config.additional_variable.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `key` (`string`): Key for the configVariable
+  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable. When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.additional_variable.encryption_key_value.new](#fn-eventing_configeventing_configencryption_key_valuenew) constructor.
+  - `secret_value` (`list[obj]`): Secret value of configVariable When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.additional_variable.secret_value.new](#fn-eventing_configeventing_configsecret_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `additional_variable` sub block.
+
+
+## obj eventing_config.additional_variable.encryption_key_value
+
+
+
+### fn eventing_config.additional_variable.encryption_key_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected
+format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+Will be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `type` (`string`): Type of Encryption Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"] When `null`, the `type` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `encryption_key_value` sub block.
+
+
+## obj eventing_config.additional_variable.secret_value
+
+
+
+### fn eventing_config.additional_variable.secret_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `secret_value` sub block.
+
+
+## obj eventing_config.auth_config
+
+
+
+### fn eventing_config.auth_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.auth_config.new` constructs a new object with attributes and blocks configured for the `auth_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auth_key` (`string`): The type of authentication configured. When `null`, the `auth_key` field will be omitted from the resulting object.
+  - `auth_type` (`string`): authType of the Connection Possible values: ["USER_PASSWORD"]
+  - `additional_variable` (`list[obj]`): List containing additional auth configs. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.additional_variable.new](#fn-eventing_configeventing_configadditional_variablenew) constructor.
+  - `user_password` (`list[obj]`): User password for Authentication. When `null`, the `user_password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.user_password.new](#fn-eventing_configeventing_configuser_passwordnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `auth_config` sub block.
+
+
+## obj eventing_config.auth_config.additional_variable
+
+
+
+### fn eventing_config.auth_config.additional_variable.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.auth_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `key` (`string`): Key for the configVariable
+  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.additional_variable.encryption_key_value.new](#fn-eventing_configeventing_configauth_configencryption_key_valuenew) constructor.
+  - `secret_value` (`list[obj]`): Secret value of configVariable When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.additional_variable.secret_value.new](#fn-eventing_configeventing_configauth_configsecret_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `additional_variable` sub block.
+
+
+## obj eventing_config.auth_config.additional_variable.encryption_key_value
+
+
+
+### fn eventing_config.auth_config.additional_variable.encryption_key_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.auth_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected
+format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+Will be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"] When `null`, the `type` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `encryption_key_value` sub block.
+
+
+## obj eventing_config.auth_config.additional_variable.secret_value
+
+
+
+### fn eventing_config.auth_config.additional_variable.secret_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.auth_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `secret_value` sub block.
+
+
+## obj eventing_config.auth_config.user_password
+
+
+
+### fn eventing_config.auth_config.user_password.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.auth_config.user_password.new` constructs a new object with attributes and blocks configured for the `user_password`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): Username for Authentication. When `null`, the `username` field will be omitted from the resulting object.
+  - `password` (`list[obj]`): Password for Authentication. When `null`, the `password` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.auth_config.user_password.password.new](#fn-eventing_configeventing_configauth_configpasswordnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `user_password` sub block.
+
+
+## obj eventing_config.auth_config.user_password.password
+
+
+
+### fn eventing_config.auth_config.user_password.password.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.auth_config.user_password.password.new` constructs a new object with attributes and blocks configured for the `password`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): The resource name of the secret version in the format,
+format as: projects/*/secrets/*/versions/*.
+
+**Returns**:
+  - An attribute object that represents the `password` sub block.
+
+
+## obj eventing_config.registration_destination_config
+
+
+
+### fn eventing_config.registration_destination_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.registration_destination_config.new` constructs a new object with attributes and blocks configured for the `registration_destination_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): Key for the connection When `null`, the `key` field will be omitted from the resulting object.
+  - `destination` (`list[obj]`): destinations for the connection When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.eventing_config.registration_destination_config.destination.new](#fn-eventing_configeventing_configdestinationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `registration_destination_config` sub block.
+
+
+## obj eventing_config.registration_destination_config.destination
+
+
+
+### fn eventing_config.registration_destination_config.destination.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.eventing_config.registration_destination_config.destination.new` constructs a new object with attributes and blocks configured for the `destination`
+Terraform sub block.
+
+
+
+**Args**:
+  - `host` (`string`): Host When `null`, the `host` field will be omitted from the resulting object.
+  - `port` (`number`): port number When `null`, the `port` field will be omitted from the resulting object.
+  - `service_attachment` (`string`): Service Attachment When `null`, the `service_attachment` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `destination` sub block.
+
+
+## obj lock_config
+
+
+
+### fn lock_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.lock_config.new` constructs a new object with attributes and blocks configured for the `lock_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `locked` (`bool`): Indicates whether or not the connection is locked.
+  - `reason` (`string`): Describes why a connection is locked. When `null`, the `reason` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `lock_config` sub block.
+
+
+## obj log_config
+
+
+
+### fn log_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.log_config.new` constructs a new object with attributes and blocks configured for the `log_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Enabled represents whether logging is enabled or not for a connection.
+
+**Returns**:
+  - An attribute object that represents the `log_config` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_node_count` (`number`): Minimum number of nodes in the runtime nodes. When `null`, the `max_node_count` field will be omitted from the resulting object.
+  - `min_node_count` (`number`): Minimum number of nodes in the runtime nodes. When `null`, the `min_node_count` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj ssl_config
+
+
+
+### fn ssl_config.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.new` constructs a new object with attributes and blocks configured for the `ssl_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `client_cert_type` (`string`): Type of Client Cert (PEM/JKS/.. etc.) Possible values: ["PEM"] When `null`, the `client_cert_type` field will be omitted from the resulting object.
+  - `server_cert_type` (`string`): Type of Server Cert (PEM/JKS/.. etc.) Possible values: ["PEM"] When `null`, the `server_cert_type` field will be omitted from the resulting object.
+  - `trust_model` (`string`): Enum for Trust Model Possible values: ["PUBLIC", "PRIVATE", "INSECURE"] When `null`, the `trust_model` field will be omitted from the resulting object.
+  - `type` (`string`): Enum for controlling the SSL Type (TLS/MTLS) Possible values: ["TLS", "MTLS"]
+  - `use_ssl` (`bool`): Bool for enabling SSL When `null`, the `use_ssl` field will be omitted from the resulting object.
+  - `additional_variable` (`list[obj]`): Additional SSL related field values. When `null`, the `additional_variable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.additional_variable.new](#fn-ssl_configadditional_variablenew) constructor.
+  - `client_certificate` (`list[obj]`): Client Certificate When `null`, the `client_certificate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.client_certificate.new](#fn-ssl_configclient_certificatenew) constructor.
+  - `client_private_key` (`list[obj]`): Client Private Key When `null`, the `client_private_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.client_private_key.new](#fn-ssl_configclient_private_keynew) constructor.
+  - `client_private_key_pass` (`list[obj]`): Secret containing the passphrase protecting the Client Private Key When `null`, the `client_private_key_pass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.client_private_key_pass.new](#fn-ssl_configclient_private_key_passnew) constructor.
+  - `private_server_certificate` (`list[obj]`): Private Server Certificate. Needs to be specified if trust model is PRIVATE. When `null`, the `private_server_certificate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.private_server_certificate.new](#fn-ssl_configprivate_server_certificatenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ssl_config` sub block.
+
+
+## obj ssl_config.additional_variable
+
+
+
+### fn ssl_config.additional_variable.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.additional_variable.new` constructs a new object with attributes and blocks configured for the `additional_variable`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): Boolean Value of configVariable. When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `integer_value` (`number`): Integer Value of configVariable. When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `key` (`string`): Key for the configVariable
+  - `string_value` (`string`): String Value of configVariabley. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `encryption_key_value` (`list[obj]`): Encription key value of configVariable When `null`, the `encryption_key_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.additional_variable.encryption_key_value.new](#fn-ssl_configssl_configencryption_key_valuenew) constructor.
+  - `secret_value` (`list[obj]`): Secret value of configVariable When `null`, the `secret_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_connection.ssl_config.additional_variable.secret_value.new](#fn-ssl_configssl_configsecret_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `additional_variable` sub block.
+
+
+## obj ssl_config.additional_variable.encryption_key_value
+
+
+
+### fn ssl_config.additional_variable.encryption_key_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.additional_variable.encryption_key_value.new` constructs a new object with attributes and blocks configured for the `encryption_key_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key_name` (`string`): The [KMS key name] with which the content of the Operation is encrypted. The expected
+format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+Will be empty string if google managed. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `type` (`string`): Type of Encription Key Possible values: ["GOOGLE_MANAGED", "CUSTOMER_MANAGED"] When `null`, the `type` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `encryption_key_value` sub block.
+
+
+## obj ssl_config.additional_variable.secret_value
+
+
+
+### fn ssl_config.additional_variable.secret_value.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.additional_variable.secret_value.new` constructs a new object with attributes and blocks configured for the `secret_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `secret_value` sub block.
+
+
+## obj ssl_config.client_certificate
+
+
+
+### fn ssl_config.client_certificate.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.client_certificate.new` constructs a new object with attributes and blocks configured for the `client_certificate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `client_certificate` sub block.
+
+
+## obj ssl_config.client_private_key
+
+
+
+### fn ssl_config.client_private_key.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.client_private_key.new` constructs a new object with attributes and blocks configured for the `client_private_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `client_private_key` sub block.
+
+
+## obj ssl_config.client_private_key_pass
+
+
+
+### fn ssl_config.client_private_key_pass.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.client_private_key_pass.new` constructs a new object with attributes and blocks configured for the `client_private_key_pass`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `client_private_key_pass` sub block.
+
+
+## obj ssl_config.private_server_certificate
+
+
+
+### fn ssl_config.private_server_certificate.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.ssl_config.private_server_certificate.new` constructs a new object with attributes and blocks configured for the `private_server_certificate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `secret_version` (`string`): Secret version of Secret Value for Config variable.
+
+**Returns**:
+  - An attribute object that represents the `private_server_certificate` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/integration_connectors_endpoint_attachment.md b/docs/4.x/integration_connectors_endpoint_attachment.md
new file mode 100644
index 00000000..cf672c13
--- /dev/null
+++ b/docs/4.x/integration_connectors_endpoint_attachment.md
@@ -0,0 +1,262 @@
+---
+permalink: /integration_connectors_endpoint_attachment/
+---
+
+# integration_connectors_endpoint_attachment
+
+`integration_connectors_endpoint_attachment` represents the `google_integration_connectors_endpoint_attachment` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withServiceAttachment()`](#fn-withserviceattachment)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_endpoint_attachment.new` injects a new `google_integration_connectors_endpoint_attachment` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.integration_connectors_endpoint_attachment.new('some_id')
+
+You can get the reference to the `id` field of the created `google.integration_connectors_endpoint_attachment` using the reference:
+
+    $._ref.google_integration_connectors_endpoint_attachment.some_id.get('id')
+
+This is the same as directly entering `"${ google_integration_connectors_endpoint_attachment.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): Description of the resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location in which Endpoint Attachment needs to be created.
+  - `name` (`string`): Name of Endpoint Attachment needs to be created.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `service_attachment` (`string`): The path of the service attachment.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_endpoint_attachment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.integration_connectors_endpoint_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `integration_connectors_endpoint_attachment`
+Terraform resource.
+
+Unlike [google.integration_connectors_endpoint_attachment.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): Description of the resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location in which Endpoint Attachment needs to be created.
+  - `name` (`string`): Name of Endpoint Attachment needs to be created.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `service_attachment` (`string`): The path of the service attachment.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.integration_connectors_endpoint_attachment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `integration_connectors_endpoint_attachment` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withServiceAttachment
+
+```ts
+withServiceAttachment()
+```
+
+`google.string.withServiceAttachment` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the service_attachment field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `service_attachment` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.integration_connectors_endpoint_attachment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/kms_crypto_key.md b/docs/4.x/kms_crypto_key.md
index d0ee381a..34e57ebb 100644
--- a/docs/4.x/kms_crypto_key.md
+++ b/docs/4.x/kms_crypto_key.md
@@ -66,7 +66,11 @@ If not specified at creation time, the default duration is 24 hours. When `null`
   - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.
   - `key_ring` (`string`): The KeyRing that this key belongs to.
 Format: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the CryptoKey.
   - `purpose` (`string`): The immutable purpose of this CryptoKey. See the
 [purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)
@@ -108,7 +112,11 @@ If not specified at creation time, the default duration is 24 hours. When `null`
   - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.
   - `key_ring` (`string`): The KeyRing that this key belongs to.
 Format: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the CryptoKey.
   - `purpose` (`string`): The immutable purpose of this CryptoKey. See the
 [purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)
diff --git a/docs/4.x/logging_billing_account_bucket_config.md b/docs/4.x/logging_billing_account_bucket_config.md
index a09519b2..d21e8421 100644
--- a/docs/4.x/logging_billing_account_bucket_config.md
+++ b/docs/4.x/logging_billing_account_bucket_config.md
@@ -20,10 +20,14 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCmekSettings()`](#fn-withcmeksettings)
 * [`fn withCmekSettingsMixin()`](#fn-withcmeksettingsmixin)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withIndexConfigs()`](#fn-withindexconfigs)
+* [`fn withIndexConfigsMixin()`](#fn-withindexconfigsmixin)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withRetentionDays()`](#fn-withretentiondays)
 * [`obj cmek_settings`](#obj-cmek_settings)
   * [`fn new()`](#fn-cmek_settingsnew)
+* [`obj index_configs`](#obj-index_configs)
+  * [`fn new()`](#fn-index_configsnew)
 
 ## Fields
 
@@ -60,6 +64,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `location` (`string`): The location of the bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -89,6 +94,7 @@ injecting into a complete block.
   - `location` (`string`): The location of the bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_billing_account_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_billing_account_bucket_config` resource into the root Terraform configuration.
@@ -179,6 +185,43 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withIndexConfigs
+
+```ts
+withIndexConfigs()
+```
+
+`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
+### fn withIndexConfigsMixin
+
+```ts
+withIndexConfigsMixin()
+```
+
+`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
 ### fn withLocation
 
 ```ts
@@ -237,3 +280,29 @@ See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/ro
 
 **Returns**:
   - An attribute object that represents the `cmek_settings` sub block.
+
+
+## obj index_configs
+
+
+
+### fn index_configs.new
+
+```ts
+new()
+```
+
+
+`google.logging_billing_account_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `field_path` (`string`): The LogEntry field path to index.
+  - `type` (`string`): The type of data in this index
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+For example: jsonPayload.request.status
+
+**Returns**:
+  - An attribute object that represents the `index_configs` sub block.
diff --git a/docs/4.x/logging_folder_bucket_config.md b/docs/4.x/logging_folder_bucket_config.md
index 0e9fa3de..7a5b4ee3 100644
--- a/docs/4.x/logging_folder_bucket_config.md
+++ b/docs/4.x/logging_folder_bucket_config.md
@@ -20,10 +20,14 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCmekSettingsMixin()`](#fn-withcmeksettingsmixin)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withFolder()`](#fn-withfolder)
+* [`fn withIndexConfigs()`](#fn-withindexconfigs)
+* [`fn withIndexConfigsMixin()`](#fn-withindexconfigsmixin)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withRetentionDays()`](#fn-withretentiondays)
 * [`obj cmek_settings`](#obj-cmek_settings)
   * [`fn new()`](#fn-cmek_settingsnew)
+* [`obj index_configs`](#obj-index_configs)
+  * [`fn new()`](#fn-index_configsnew)
 
 ## Fields
 
@@ -60,6 +64,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `location` (`string`): The location of the bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -89,6 +94,7 @@ injecting into a complete block.
   - `location` (`string`): The location of the bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_folder_bucket_config` resource into the root Terraform configuration.
@@ -179,6 +185,43 @@ Terraform resource block to set or update the folder field.
   - `value` (`string`): The value to set for the `folder` field.
 
 
+### fn withIndexConfigs
+
+```ts
+withIndexConfigs()
+```
+
+`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
+### fn withIndexConfigsMixin
+
+```ts
+withIndexConfigsMixin()
+```
+
+`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
 ### fn withLocation
 
 ```ts
@@ -237,3 +280,29 @@ See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/ro
 
 **Returns**:
   - An attribute object that represents the `cmek_settings` sub block.
+
+
+## obj index_configs
+
+
+
+### fn index_configs.new
+
+```ts
+new()
+```
+
+
+`google.logging_folder_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `field_path` (`string`): The LogEntry field path to index.
+  - `type` (`string`): The type of data in this index
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+For example: jsonPayload.request.status
+
+**Returns**:
+  - An attribute object that represents the `index_configs` sub block.
diff --git a/docs/4.x/logging_folder_settings.md b/docs/4.x/logging_folder_settings.md
new file mode 100644
index 00000000..9a0952da
--- /dev/null
+++ b/docs/4.x/logging_folder_settings.md
@@ -0,0 +1,216 @@
+---
+permalink: /logging_folder_settings/
+---
+
+# logging_folder_settings
+
+`logging_folder_settings` represents the `google_logging_folder_settings` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDisableDefaultSink()`](#fn-withdisabledefaultsink)
+* [`fn withFolder()`](#fn-withfolder)
+* [`fn withKmsKeyName()`](#fn-withkmskeyname)
+* [`fn withStorageLocation()`](#fn-withstoragelocation)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.logging_folder_settings.new` injects a new `google_logging_folder_settings` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.logging_folder_settings.new('some_id')
+
+You can get the reference to the `id` field of the created `google.logging_folder_settings` using the reference:
+
+    $._ref.google_logging_folder_settings.some_id.get('id')
+
+This is the same as directly entering `"${ google_logging_folder_settings.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.
+  - `folder` (`string`): The folder for which to retrieve settings.
+  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_settings.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.logging_folder_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_folder_settings`
+Terraform resource.
+
+Unlike [google.logging_folder_settings.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.
+  - `folder` (`string`): The folder for which to retrieve settings.
+  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_folder_settings.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_folder_settings` resource into the root Terraform configuration.
+
+
+### fn withDisableDefaultSink
+
+```ts
+withDisableDefaultSink()
+```
+
+`google.bool.withDisableDefaultSink` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the disable_default_sink field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `disable_default_sink` field.
+
+
+### fn withFolder
+
+```ts
+withFolder()
+```
+
+`google.string.withFolder` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the folder field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `folder` field.
+
+
+### fn withKmsKeyName
+
+```ts
+withKmsKeyName()
+```
+
+`google.string.withKmsKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kms_key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kms_key_name` field.
+
+
+### fn withStorageLocation
+
+```ts
+withStorageLocation()
+```
+
+`google.string.withStorageLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the storage_location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `storage_location` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.logging_folder_settings.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/logging_metric.md b/docs/4.x/logging_metric.md
index f282097d..c47a9759 100644
--- a/docs/4.x/logging_metric.md
+++ b/docs/4.x/logging_metric.md
@@ -468,9 +468,9 @@ Terraform sub block.
 
 
 **Args**:
-  - `growth_factor` (`number`): Must be greater than 1. When `null`, the `growth_factor` field will be omitted from the resulting object.
-  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.
-  - `scale` (`number`): Must be greater than 0. When `null`, the `scale` field will be omitted from the resulting object.
+  - `growth_factor` (`number`): Must be greater than 1.
+  - `num_finite_buckets` (`number`): Must be greater than 0.
+  - `scale` (`number`): Must be greater than 0.
 
 **Returns**:
   - An attribute object that represents the `exponential_buckets` sub block.
@@ -493,9 +493,9 @@ Terraform sub block.
 
 
 **Args**:
-  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.
-  - `offset` (`number`): Lower bound of the first bucket. When `null`, the `offset` field will be omitted from the resulting object.
-  - `width` (`number`): Must be greater than 0. When `null`, the `width` field will be omitted from the resulting object.
+  - `num_finite_buckets` (`number`): Must be greater than 0.
+  - `offset` (`number`): Lower bound of the first bucket.
+  - `width` (`number`): Must be greater than 0.
 
 **Returns**:
   - An attribute object that represents the `linear_buckets` sub block.
diff --git a/docs/4.x/logging_organization_bucket_config.md b/docs/4.x/logging_organization_bucket_config.md
index 66f3df4e..a2ced1db 100644
--- a/docs/4.x/logging_organization_bucket_config.md
+++ b/docs/4.x/logging_organization_bucket_config.md
@@ -19,11 +19,15 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCmekSettings()`](#fn-withcmeksettings)
 * [`fn withCmekSettingsMixin()`](#fn-withcmeksettingsmixin)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withIndexConfigs()`](#fn-withindexconfigs)
+* [`fn withIndexConfigsMixin()`](#fn-withindexconfigsmixin)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withOrganization()`](#fn-withorganization)
 * [`fn withRetentionDays()`](#fn-withretentiondays)
 * [`obj cmek_settings`](#obj-cmek_settings)
   * [`fn new()`](#fn-cmek_settingsnew)
+* [`obj index_configs`](#obj-index_configs)
+  * [`fn new()`](#fn-index_configsnew)
 
 ## Fields
 
@@ -60,6 +64,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `organization` (`string`): The parent resource that contains the logging bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -89,6 +94,7 @@ injecting into a complete block.
   - `organization` (`string`): The parent resource that contains the logging bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_organization_bucket_config` resource into the root Terraform configuration.
@@ -163,6 +169,43 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withIndexConfigs
+
+```ts
+withIndexConfigs()
+```
+
+`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
+### fn withIndexConfigsMixin
+
+```ts
+withIndexConfigsMixin()
+```
+
+`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
 ### fn withLocation
 
 ```ts
@@ -237,3 +280,29 @@ See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/ro
 
 **Returns**:
   - An attribute object that represents the `cmek_settings` sub block.
+
+
+## obj index_configs
+
+
+
+### fn index_configs.new
+
+```ts
+new()
+```
+
+
+`google.logging_organization_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `field_path` (`string`): The LogEntry field path to index.
+  - `type` (`string`): The type of data in this index
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+For example: jsonPayload.request.status
+
+**Returns**:
+  - An attribute object that represents the `index_configs` sub block.
diff --git a/docs/4.x/logging_organization_settings.md b/docs/4.x/logging_organization_settings.md
new file mode 100644
index 00000000..561cbf86
--- /dev/null
+++ b/docs/4.x/logging_organization_settings.md
@@ -0,0 +1,216 @@
+---
+permalink: /logging_organization_settings/
+---
+
+# logging_organization_settings
+
+`logging_organization_settings` represents the `google_logging_organization_settings` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDisableDefaultSink()`](#fn-withdisabledefaultsink)
+* [`fn withKmsKeyName()`](#fn-withkmskeyname)
+* [`fn withOrganization()`](#fn-withorganization)
+* [`fn withStorageLocation()`](#fn-withstoragelocation)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.logging_organization_settings.new` injects a new `google_logging_organization_settings` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.logging_organization_settings.new('some_id')
+
+You can get the reference to the `id` field of the created `google.logging_organization_settings` using the reference:
+
+    $._ref.google_logging_organization_settings.some_id.get('id')
+
+This is the same as directly entering `"${ google_logging_organization_settings.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.
+  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `organization` (`string`): The organization for which to retrieve or configure settings.
+  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_settings.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.logging_organization_settings.newAttrs` constructs a new object with attributes and blocks configured for the `logging_organization_settings`
+Terraform resource.
+
+Unlike [google.logging_organization_settings.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `disable_default_sink` (`bool`): If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed. When `null`, the `disable_default_sink` field will be omitted from the resulting object.
+  - `kms_key_name` (`string`): The resource name for the configured Cloud KMS key. When `null`, the `kms_key_name` field will be omitted from the resulting object.
+  - `organization` (`string`): The organization for which to retrieve or configure settings.
+  - `storage_location` (`string`): The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided. When `null`, the `storage_location` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_organization_settings.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_organization_settings` resource into the root Terraform configuration.
+
+
+### fn withDisableDefaultSink
+
+```ts
+withDisableDefaultSink()
+```
+
+`google.bool.withDisableDefaultSink` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the disable_default_sink field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `disable_default_sink` field.
+
+
+### fn withKmsKeyName
+
+```ts
+withKmsKeyName()
+```
+
+`google.string.withKmsKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kms_key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kms_key_name` field.
+
+
+### fn withOrganization
+
+```ts
+withOrganization()
+```
+
+`google.string.withOrganization` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the organization field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `organization` field.
+
+
+### fn withStorageLocation
+
+```ts
+withStorageLocation()
+```
+
+`google.string.withStorageLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the storage_location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `storage_location` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.logging_organization_settings.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/logging_project_bucket_config.md b/docs/4.x/logging_project_bucket_config.md
index 1053b46b..579e5ad3 100644
--- a/docs/4.x/logging_project_bucket_config.md
+++ b/docs/4.x/logging_project_bucket_config.md
@@ -20,12 +20,16 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCmekSettingsMixin()`](#fn-withcmeksettingsmixin)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withEnableAnalytics()`](#fn-withenableanalytics)
+* [`fn withIndexConfigs()`](#fn-withindexconfigs)
+* [`fn withIndexConfigsMixin()`](#fn-withindexconfigsmixin)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withLocked()`](#fn-withlocked)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRetentionDays()`](#fn-withretentiondays)
 * [`obj cmek_settings`](#obj-cmek_settings)
   * [`fn new()`](#fn-cmek_settingsnew)
+* [`obj index_configs`](#obj-index_configs)
+  * [`fn new()`](#fn-index_configsnew)
 
 ## Fields
 
@@ -64,6 +68,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `project` (`string`): The parent project that contains the logging bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -95,6 +100,7 @@ injecting into a complete block.
   - `project` (`string`): The parent project that contains the logging bucket.
   - `retention_days` (`number`): Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. When `null`, the `retention_days` field will be omitted from the resulting object.
   - `cmek_settings` (`list[obj]`): The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. When `null`, the `cmek_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.cmek_settings.new](#fn-cmek_settingsnew) constructor.
+  - `index_configs` (`list[obj]`): A list of indexed fields and related configuration data. When `null`, the `index_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_bucket_config.index_configs.new](#fn-index_configsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_bucket_config` resource into the root Terraform configuration.
@@ -185,6 +191,43 @@ Terraform resource block to set or update the enable_analytics field.
   - `value` (`bool`): The value to set for the `enable_analytics` field.
 
 
+### fn withIndexConfigs
+
+```ts
+withIndexConfigs()
+```
+
+`google.list[obj].withIndexConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIndexConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
+### fn withIndexConfigsMixin
+
+```ts
+withIndexConfigsMixin()
+```
+
+`google.list[obj].withIndexConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the index_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIndexConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `index_configs` field.
+
+
 ### fn withLocation
 
 ```ts
@@ -275,3 +318,29 @@ See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/ro
 
 **Returns**:
   - An attribute object that represents the `cmek_settings` sub block.
+
+
+## obj index_configs
+
+
+
+### fn index_configs.new
+
+```ts
+new()
+```
+
+
+`google.logging_project_bucket_config.index_configs.new` constructs a new object with attributes and blocks configured for the `index_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `field_path` (`string`): The LogEntry field path to index.
+  - `type` (`string`): The type of data in this index
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+For example: jsonPayload.request.status
+
+**Returns**:
+  - An attribute object that represents the `index_configs` sub block.
diff --git a/docs/4.x/logging_project_sink.md b/docs/4.x/logging_project_sink.md
index ac4238c5..ad649b2f 100644
--- a/docs/4.x/logging_project_sink.md
+++ b/docs/4.x/logging_project_sink.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withBigqueryOptions()`](#fn-withbigqueryoptions)
 * [`fn withBigqueryOptionsMixin()`](#fn-withbigqueryoptionsmixin)
+* [`fn withCustomWriterIdentity()`](#fn-withcustomwriteridentity)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDestination()`](#fn-withdestination)
 * [`fn withDisabled()`](#fn-withdisabled)
@@ -60,13 +61,14 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.
   - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.
   - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.
   - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.
   - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.
   - `name` (`string`): The name of the logging sink.
   - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.
-  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
+  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
   - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.
   - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.
 
@@ -92,13 +94,14 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.
   - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.
   - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.
   - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.
   - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.
   - `name` (`string`): The name of the logging sink.
   - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.
-  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
+  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
   - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.
   - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.
 
@@ -143,6 +146,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `bigquery_options` field.
 
 
+### fn withCustomWriterIdentity
+
+```ts
+withCustomWriterIdentity()
+```
+
+`google.string.withCustomWriterIdentity` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the custom_writer_identity field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `custom_writer_identity` field.
+
+
 ### fn withDescription
 
 ```ts
diff --git a/docs/4.x/looker_instance.md b/docs/4.x/looker_instance.md
index 57e244eb..07215f4f 100644
--- a/docs/4.x/looker_instance.md
+++ b/docs/4.x/looker_instance.md
@@ -98,8 +98,7 @@ project that is hosting the Looker Instance. When `null`, the `consumer_network`
 - LOOKER_CORE_STANDARD: pay as you go standard instance
 - LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance
 - LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance
-- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance
-- LOOKER_MODELER: standalone modeling service Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL", "LOOKER_MODELER"] When `null`, the `platform_edition` field will be omitted from the resulting object.
+- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL"] When `null`, the `platform_edition` field will be omitted from the resulting object.
   - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.
@@ -161,8 +160,7 @@ project that is hosting the Looker Instance. When `null`, the `consumer_network`
 - LOOKER_CORE_STANDARD: pay as you go standard instance
 - LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance
 - LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance
-- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance
-- LOOKER_MODELER: standalone modeling service Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL", "LOOKER_MODELER"] When `null`, the `platform_edition` field will be omitted from the resulting object.
+- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL"] When `null`, the `platform_edition` field will be omitted from the resulting object.
   - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.
diff --git a/docs/4.x/memcache_instance.md b/docs/4.x/memcache_instance.md
index 2f3ff8f8..95c67403 100644
--- a/docs/4.x/memcache_instance.md
+++ b/docs/4.x/memcache_instance.md
@@ -29,6 +29,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withNodeCount()`](#fn-withnodecount)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRegion()`](#fn-withregion)
+* [`fn withReservedIpRangeId()`](#fn-withreservediprangeid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withZones()`](#fn-withzones)
@@ -77,14 +78,21 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,
 'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.
 Currently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically
-determined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.
+determined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5", "MEMCACHE_1_6_15"] When `null`, the `memcache_version` field will be omitted from the resulting object.
   - `name` (`string`): The resource name of the instance.
   - `node_count` (`number`): Number of nodes in the memcache instance.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
+  - `reserved_ip_range_id` (`list`): Contains the name of allocated IP address ranges associated with
+the private service access connection for example, "test-default"
+associated with IP range 10.0.0.0/29. When `null`, the `reserved_ip_range_id` field will be omitted from the resulting object.
   - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not
 provided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.
   - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.
@@ -117,14 +125,21 @@ injecting into a complete block.
   - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,
 'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.
 Currently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically
-determined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.
+determined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5", "MEMCACHE_1_6_15"] When `null`, the `memcache_version` field will be omitted from the resulting object.
   - `name` (`string`): The resource name of the instance.
   - `node_count` (`number`): Number of nodes in the memcache instance.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
+  - `reserved_ip_range_id` (`list`): Contains the name of allocated IP address ranges associated with
+the private service access connection for example, "test-default"
+associated with IP range 10.0.0.0/29. When `null`, the `reserved_ip_range_id` field will be omitted from the resulting object.
   - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not
 provided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.
   - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.
@@ -375,6 +390,22 @@ Terraform resource block to set or update the region field.
   - `value` (`string`): The value to set for the `region` field.
 
 
+### fn withReservedIpRangeId
+
+```ts
+withReservedIpRangeId()
+```
+
+`google.list.withReservedIpRangeId` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the reserved_ip_range_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `reserved_ip_range_id` field.
+
+
 ### fn withTimeouts
 
 ```ts
diff --git a/docs/4.x/migration_center_group.md b/docs/4.x/migration_center_group.md
new file mode 100644
index 00000000..350dbf32
--- /dev/null
+++ b/docs/4.x/migration_center_group.md
@@ -0,0 +1,260 @@
+---
+permalink: /migration_center_group/
+---
+
+# migration_center_group
+
+`migration_center_group` represents the `google_migration_center_group` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withGroupId()`](#fn-withgroupid)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.migration_center_group.new` injects a new `google_migration_center_group` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.migration_center_group.new('some_id')
+
+You can get the reference to the `id` field of the created `google.migration_center_group` using the reference:
+
+    $._ref.google_migration_center_group.some_id.get('id')
+
+This is the same as directly entering `"${ google_migration_center_group.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): Optional. The description of the group. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): Optional. User-friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `group_id` (`string`): Required. User specified ID for the group. It will become the last component of the group name. The ID must be unique within the project, must conform with RFC-1034, is restricted to lower-cased letters, and has a maximum length of 63 characters. The ID must match the regular expression: '[a-z]([a-z0-9-]{0,61}[a-z0-9])?'.
+  - `labels` (`obj`): Labels as key value pairs. 
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the group.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.migration_center_group.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.migration_center_group.newAttrs` constructs a new object with attributes and blocks configured for the `migration_center_group`
+Terraform resource.
+
+Unlike [google.migration_center_group.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): Optional. The description of the group. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): Optional. User-friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `group_id` (`string`): Required. User specified ID for the group. It will become the last component of the group name. The ID must be unique within the project, must conform with RFC-1034, is restricted to lower-cased letters, and has a maximum length of 63 characters. The ID must match the regular expression: '[a-z]([a-z0-9-]{0,61}[a-z0-9])?'.
+  - `labels` (`obj`): Labels as key value pairs. 
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the group.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.migration_center_group.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `migration_center_group` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withGroupId
+
+```ts
+withGroupId()
+```
+
+`google.string.withGroupId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the group_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `group_id` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.migration_center_group.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/ml_engine_model.md b/docs/4.x/ml_engine_model.md
index b4981e3a..b9f952a2 100644
--- a/docs/4.x/ml_engine_model.md
+++ b/docs/4.x/ml_engine_model.md
@@ -61,7 +61,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): One or more labels that you can add, to organize your models.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name specified for the model.
   - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.
   - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.
@@ -95,7 +98,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): One or more labels that you can add, to organize your models.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name specified for the model.
   - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.
   - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.
@@ -337,6 +343,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/monitoring_alert_policy.md b/docs/4.x/monitoring_alert_policy.md
index cb2f366a..aac354e4 100644
--- a/docs/4.x/monitoring_alert_policy.md
+++ b/docs/4.x/monitoring_alert_policy.md
@@ -26,6 +26,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEnabled()`](#fn-withenabled)
 * [`fn withNotificationChannels()`](#fn-withnotificationchannels)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withSeverity()`](#fn-withseverity)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withUserLabels()`](#fn-withuserlabels)
@@ -110,6 +111,9 @@ returned from the notificationChannels.list method. The syntax of the
 entries in this field is
 'projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]' When `null`, the `notification_channels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `severity` (`string`): The severity of an alert policy indicates how important incidents generated
+by that policy are. The severity level will be displayed on the Incident
+detail page and in notifications. Possible values: ["CRITICAL", "ERROR", "WARNING"] When `null`, the `severity` field will be omitted from the resulting object.
   - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy
 objects.The field can contain up to 64 entries. Each key and value is limited
 to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values
@@ -164,6 +168,9 @@ returned from the notificationChannels.list method. The syntax of the
 entries in this field is
 'projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]' When `null`, the `notification_channels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `severity` (`string`): The severity of an alert policy indicates how important incidents generated
+by that policy are. The severity level will be displayed on the Incident
+detail page and in notifications. Possible values: ["CRITICAL", "ERROR", "WARNING"] When `null`, the `severity` field will be omitted from the resulting object.
   - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy
 objects.The field can contain up to 64 entries. Each key and value is limited
 to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values
@@ -376,6 +383,22 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withSeverity
+
+```ts
+withSeverity()
+```
+
+`google.string.withSeverity` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the severity field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `severity` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -532,9 +555,7 @@ continues to receive new data points. When `null`, the `condition_absent` sub bl
   - `condition_matched_log` (`list[obj]`): A condition that checks for log messages matching given constraints.
 If set, no other conditions can be present. When `null`, the `condition_matched_log` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_matched_log.new](#fn-conditionscondition_matched_lognew) constructor.
   - `condition_monitoring_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream When `null`, the `condition_monitoring_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_monitoring_query_language.new](#fn-conditionscondition_monitoring_query_languagenew) constructor.
-  - `condition_prometheus_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream
-
-A condition type that allows alert policies to be defined using
+  - `condition_prometheus_query_language` (`list[obj]`): A condition type that allows alert policies to be defined using
 Prometheus Query Language (PromQL).
 
 The PrometheusQueryLanguageCondition message contains information
@@ -884,10 +905,7 @@ Some external tools may require this field to be populated correctly
 in order to refer to the original Prometheus configuration file.
 The rule group name and the alert name are necessary to update the
 relevant AlertPolicies in case the definition of the rule group changes
-in the future.
-
-This field is optional. If this field is not empty, then it must be a
-valid Prometheus label name. When `null`, the `rule_group` field will be omitted from the resulting object.
+in the future. This field is optional. When `null`, the `rule_group` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `condition_prometheus_query_language` sub block.
@@ -1282,6 +1300,10 @@ exceed more than 10,240 bytes when encoded in UTF-8 format,
 whichever is smaller. When `null`, the `content` field will be omitted from the resulting object.
   - `mime_type` (`string`): The format of the content field. Presently, only the value
 "text/markdown" is supported. When `null`, the `mime_type` field will be omitted from the resulting object.
+  - `subject` (`string`): The subject line of the notification. The subject line may not
+exceed 10,240 bytes. In notifications generated by this policy the contents
+of the subject line after variable expansion will be truncated to 255 bytes
+or shorter at the latest UTF-8 character boundary. When `null`, the `subject` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `documentation` sub block.
diff --git a/docs/4.x/monitoring_uptime_check_config.md b/docs/4.x/monitoring_uptime_check_config.md
index ef93b694..a02e3e87 100644
--- a/docs/4.x/monitoring_uptime_check_config.md
+++ b/docs/4.x/monitoring_uptime_check_config.md
@@ -35,6 +35,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeout()`](#fn-withtimeout)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUserLabels()`](#fn-withuserlabels)
 * [`obj content_matchers`](#obj-content_matchers)
   * [`fn new()`](#fn-content_matchersnew)
   * [`obj content_matchers.json_path_matcher`](#obj-content_matchersjson_path_matcher)
@@ -45,6 +46,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-http_checkaccepted_response_status_codesnew)
   * [`obj http_check.auth_info`](#obj-http_checkauth_info)
     * [`fn new()`](#fn-http_checkauth_infonew)
+  * [`obj http_check.ping_config`](#obj-http_checkping_config)
+    * [`fn new()`](#fn-http_checkping_confignew)
 * [`obj monitored_resource`](#obj-monitored_resource)
   * [`fn new()`](#fn-monitored_resourcenew)
 * [`obj resource_group`](#obj-resource_group)
@@ -55,6 +58,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-synthetic_monitorcloud_function_v2new)
 * [`obj tcp_check`](#obj-tcp_check)
   * [`fn new()`](#fn-tcp_checknew)
+  * [`obj tcp_check.ping_config`](#obj-tcp_checkping_config)
+    * [`fn new()`](#fn-tcp_checkping_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -87,15 +92,26 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is servicedirectory_service, checkerType must be set to VPC_CHECKERS. Possible values: ["STATIC_IP_CHECKERS", "VPC_CHECKERS"] When `null`, the `checker_type` field will be omitted from the resulting object.
+  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is 'servicedirectory_service', 'checker_type' must be set to 'VPC_CHECKERS'. Possible values: ["STATIC_IP_CHECKERS", "VPC_CHECKERS"] When `null`, the `checker_type` field will be omitted from the resulting object.
   - `display_name` (`string`): A human-friendly name for the uptime check configuration. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.
   - `period` (`string`): How often, in seconds, the uptime check is performed. Currently, the only supported values are 60s (1 minute), 300s (5 minutes), 600s (10 minutes), and 900s (15 minutes). Optional, defaults to 300s. When `null`, the `period` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `selected_regions` (`list`): The list of regions from which the check will be run. Some regions contain one location, and others contain more than one. If this field is specified, enough regions to include a minimum of 3 locations must be provided, or an error message is returned. Not specifying this field will result in uptime checks running from all regions. When `null`, the `selected_regions` field will be omitted from the resulting object.
-  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). Accepted formats https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration
+  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). [See the accepted formats]( https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration)
+  - `user_labels` (`obj`): User-supplied key/value data to be used for organizing and identifying the 'UptimeCheckConfig' objects. The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.
   - `content_matchers` (`list[obj]`): The expected content on the page the check is run against. Currently, only the first entry in the list is supported, and other entries will be ignored. The server will look for an exact match of the string in the page response's content. This field is optional and should only be specified if a content match is required. When `null`, the `content_matchers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.content_matchers.new](#fn-content_matchersnew) constructor.
   - `http_check` (`list[obj]`): Contains information needed to make an HTTP or HTTPS check. When `null`, the `http_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.new](#fn-http_checknew) constructor.
-  - `monitored_resource` (`list[obj]`): The monitored resource (https://cloud.google.com/monitoring/api/resources) associated with the configuration. The following monitored resource types are supported for uptime checks:  uptime_url  gce_instance  gae_app  aws_ec2_instance aws_elb_load_balancer  k8s_service  servicedirectory_service When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.
+  - `monitored_resource` (`list[obj]`): The [monitored resource]
+(https://cloud.google.com/monitoring/api/resources) associated with the
+configuration. The following monitored resource types are supported for
+uptime checks:
+* 'aws_ec2_instance'
+* 'aws_elb_load_balancer'
+* 'gae_app
+* 'gce_instance'
+* 'k8s_service'
+* 'servicedirectory_service'
+* 'uptime_url' When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.
   - `resource_group` (`list[obj]`): The group resource associated with the configuration. When `null`, the `resource_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.resource_group.new](#fn-resource_groupnew) constructor.
   - `synthetic_monitor` (`list[obj]`): A Synthetic Monitor deployed to a Cloud Functions V2 instance. When `null`, the `synthetic_monitor` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.synthetic_monitor.new](#fn-synthetic_monitornew) constructor.
   - `tcp_check` (`list[obj]`): Contains information needed to make a TCP check. When `null`, the `tcp_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.new](#fn-tcp_checknew) constructor.
@@ -123,15 +139,26 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is servicedirectory_service, checkerType must be set to VPC_CHECKERS. Possible values: ["STATIC_IP_CHECKERS", "VPC_CHECKERS"] When `null`, the `checker_type` field will be omitted from the resulting object.
+  - `checker_type` (`string`): The checker type to use for the check. If the monitored resource type is 'servicedirectory_service', 'checker_type' must be set to 'VPC_CHECKERS'. Possible values: ["STATIC_IP_CHECKERS", "VPC_CHECKERS"] When `null`, the `checker_type` field will be omitted from the resulting object.
   - `display_name` (`string`): A human-friendly name for the uptime check configuration. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.
   - `period` (`string`): How often, in seconds, the uptime check is performed. Currently, the only supported values are 60s (1 minute), 300s (5 minutes), 600s (10 minutes), and 900s (15 minutes). Optional, defaults to 300s. When `null`, the `period` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `selected_regions` (`list`): The list of regions from which the check will be run. Some regions contain one location, and others contain more than one. If this field is specified, enough regions to include a minimum of 3 locations must be provided, or an error message is returned. Not specifying this field will result in uptime checks running from all regions. When `null`, the `selected_regions` field will be omitted from the resulting object.
-  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). Accepted formats https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration
+  - `timeout` (`string`): The maximum amount of time to wait for the request to complete (must be between 1 and 60 seconds). [See the accepted formats]( https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration)
+  - `user_labels` (`obj`): User-supplied key/value data to be used for organizing and identifying the 'UptimeCheckConfig' objects. The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.
   - `content_matchers` (`list[obj]`): The expected content on the page the check is run against. Currently, only the first entry in the list is supported, and other entries will be ignored. The server will look for an exact match of the string in the page response's content. This field is optional and should only be specified if a content match is required. When `null`, the `content_matchers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.content_matchers.new](#fn-content_matchersnew) constructor.
   - `http_check` (`list[obj]`): Contains information needed to make an HTTP or HTTPS check. When `null`, the `http_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.new](#fn-http_checknew) constructor.
-  - `monitored_resource` (`list[obj]`): The monitored resource (https://cloud.google.com/monitoring/api/resources) associated with the configuration. The following monitored resource types are supported for uptime checks:  uptime_url  gce_instance  gae_app  aws_ec2_instance aws_elb_load_balancer  k8s_service  servicedirectory_service When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.
+  - `monitored_resource` (`list[obj]`): The [monitored resource]
+(https://cloud.google.com/monitoring/api/resources) associated with the
+configuration. The following monitored resource types are supported for
+uptime checks:
+* 'aws_ec2_instance'
+* 'aws_elb_load_balancer'
+* 'gae_app
+* 'gce_instance'
+* 'k8s_service'
+* 'servicedirectory_service'
+* 'uptime_url' When `null`, the `monitored_resource` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.monitored_resource.new](#fn-monitored_resourcenew) constructor.
   - `resource_group` (`list[obj]`): The group resource associated with the configuration. When `null`, the `resource_group` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.resource_group.new](#fn-resource_groupnew) constructor.
   - `synthetic_monitor` (`list[obj]`): A Synthetic Monitor deployed to a Cloud Functions V2 instance. When `null`, the `synthetic_monitor` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.synthetic_monitor.new](#fn-synthetic_monitornew) constructor.
   - `tcp_check` (`list[obj]`): Contains information needed to make a TCP check. When `null`, the `tcp_check` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.new](#fn-tcp_checknew) constructor.
@@ -495,6 +522,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withUserLabels
+
+```ts
+withUserLabels()
+```
+
+`google.obj.withUserLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the user_labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `user_labels` field.
+
+
 ## obj content_matchers
 
 
@@ -561,17 +604,19 @@ Terraform sub block.
 
 
 **Args**:
-  - `body` (`string`): The request body associated with the HTTP POST request. If contentType is URL_ENCODED, the body passed in must be URL-encoded. Users can provide a Content-Length header via the headers field or the API will do so. If the requestMethod is GET and body is not empty, the API will return an error. The maximum byte size is 1 megabyte. Note - As with all bytes fields JSON representations are base64 encoded. e.g. "foo=bar" in URL-encoded form is "foo%3Dbar" and in base64 encoding is "Zm9vJTI1M0RiYXI=". When `null`, the `body` field will be omitted from the resulting object.
-  - `content_type` (`string`): The content type to use for the check. Possible values: ["TYPE_UNSPECIFIED", "URL_ENCODED"] When `null`, the `content_type` field will be omitted from the resulting object.
-  - `headers` (`obj`): The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described at https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100. When `null`, the `headers` field will be omitted from the resulting object.
-  - `mask_headers` (`bool`): Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if mask_headers is set to True then the headers will be obscured with ******. When `null`, the `mask_headers` field will be omitted from the resulting object.
-  - `path` (`string`): The path to the page to run the check against. Will be combined with the host (specified within the MonitoredResource) and port to construct the full URL. If the provided path does not begin with "/", a "/" will be prepended automatically. Optional (defaults to "/"). When `null`, the `path` field will be omitted from the resulting object.
-  - `port` (`number`): The port to the page to run the check against. Will be combined with host (specified within the MonitoredResource) and path to construct the full URL. Optional (defaults to 80 without SSL, or 443 with SSL). When `null`, the `port` field will be omitted from the resulting object.
-  - `request_method` (`string`): The HTTP request method to use for the check. If set to METHOD_UNSPECIFIED then requestMethod defaults to GET. Default value: "GET" Possible values: ["METHOD_UNSPECIFIED", "GET", "POST"] When `null`, the `request_method` field will be omitted from the resulting object.
+  - `body` (`string`): The request body associated with the HTTP POST request. If 'content_type' is 'URL_ENCODED', the body passed in must be URL-encoded. Users can provide a 'Content-Length' header via the 'headers' field or the API will do so. If the 'request_method' is 'GET' and 'body' is not empty, the API will return an error. The maximum byte size is 1 megabyte. Note - As with all bytes fields JSON representations are base64 encoded. e.g. 'foo=bar' in URL-encoded form is 'foo%3Dbar' and in base64 encoding is 'Zm9vJTI1M0RiYXI='. When `null`, the `body` field will be omitted from the resulting object.
+  - `content_type` (`string`): The content type to use for the check. Possible values: ["TYPE_UNSPECIFIED", "URL_ENCODED", "USER_PROVIDED"] When `null`, the `content_type` field will be omitted from the resulting object.
+  - `custom_content_type` (`string`): A user provided content type header to use for the check. The invalid configurations outlined in the 'content_type' field apply to custom_content_type', as well as the following 1. 'content_type' is 'URL_ENCODED' and 'custom_content_type' is set. 2. 'content_type' is 'USER_PROVIDED' and 'custom_content_type' is not set. When `null`, the `custom_content_type` field will be omitted from the resulting object.
+  - `headers` (`obj`): The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described in [RFC 2616 (page 31)](https://www.w3.org/Protocols/rfc2616/rfc2616.txt). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100. When `null`, the `headers` field will be omitted from the resulting object.
+  - `mask_headers` (`bool`): Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if 'mask_headers' is set to 'true' then the headers will be obscured with '******'. When `null`, the `mask_headers` field will be omitted from the resulting object.
+  - `path` (`string`): The path to the page to run the check against. Will be combined with the host (specified within the MonitoredResource) and port to construct the full URL. If the provided path does not begin with '/', a '/' will be prepended automatically. Optional (defaults to '/'). When `null`, the `path` field will be omitted from the resulting object.
+  - `port` (`number`): The port to the page to run the check against. Will be combined with 'host' (specified within the ['monitored_resource'](#nested_monitored_resource)) and path to construct the full URL. Optional (defaults to 80 without SSL, or 443 with SSL). When `null`, the `port` field will be omitted from the resulting object.
+  - `request_method` (`string`): The HTTP request method to use for the check. If set to 'METHOD_UNSPECIFIED' then 'request_method' defaults to 'GET'. Default value: "GET" Possible values: ["METHOD_UNSPECIFIED", "GET", "POST"] When `null`, the `request_method` field will be omitted from the resulting object.
   - `use_ssl` (`bool`): If true, use HTTPS instead of HTTP to run the check. When `null`, the `use_ssl` field will be omitted from the resulting object.
-  - `validate_ssl` (`bool`): Boolean specifying whether to include SSL certificate validation as a part of the Uptime check. Only applies to checks where monitoredResource is set to uptime_url. If useSsl is false, setting validateSsl to true has no effect. When `null`, the `validate_ssl` field will be omitted from the resulting object.
+  - `validate_ssl` (`bool`): Boolean specifying whether to include SSL certificate validation as a part of the Uptime check. Only applies to checks where 'monitored_resource' is set to 'uptime_url'. If 'use_ssl' is 'false', setting 'validate_ssl' to 'true' has no effect. When `null`, the `validate_ssl` field will be omitted from the resulting object.
   - `accepted_response_status_codes` (`list[obj]`): If present, the check will only pass if the HTTP response status code is in this set of status codes. If empty, the HTTP status code will only pass if the HTTP status code is 200-299. When `null`, the `accepted_response_status_codes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.accepted_response_status_codes.new](#fn-http_checkaccepted_response_status_codesnew) constructor.
   - `auth_info` (`list[obj]`): The authentication information. Optional when creating an HTTP check; defaults to empty. When `null`, the `auth_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.auth_info.new](#fn-http_checkauth_infonew) constructor.
+  - `ping_config` (`list[obj]`): Contains information needed to add pings to an HTTP check. When `null`, the `ping_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.http_check.ping_config.new](#fn-http_checkping_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `http_check` sub block.
@@ -625,6 +670,29 @@ Terraform sub block.
   - An attribute object that represents the `auth_info` sub block.
 
 
+## obj http_check.ping_config
+
+
+
+### fn http_check.ping_config.new
+
+```ts
+new()
+```
+
+
+`google.monitoring_uptime_check_config.http_check.ping_config.new` constructs a new object with attributes and blocks configured for the `ping_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pings_count` (`number`): Number of ICMP pings. A maximum of 3 ICMP pings is currently supported.
+
+**Returns**:
+  - An attribute object that represents the `ping_config` sub block.
+
+
 ## obj monitored_resource
 
 
@@ -642,8 +710,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `labels` (`obj`): Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels "project_id", "instance_id", and "zone".
-  - `type` (`string`): The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types (https://cloud.google.com/monitoring/api/resources) and Logging resource types (https://cloud.google.com/logging/docs/api/v2/resource-list).
+  - `labels` (`obj`): Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels 'project_id', 'instance_id', and 'zone'.
+  - `type` (`string`): The monitored resource type. This field must match the type field of a ['MonitoredResourceDescriptor'](https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is 'gce_instance'. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
 
 **Returns**:
   - An attribute object that represents the `monitored_resource` sub block.
@@ -736,12 +804,36 @@ Terraform sub block.
 
 
 **Args**:
-  - `port` (`number`): The port to the page to run the check against. Will be combined with host (specified within the MonitoredResource) to construct the full URL.
+  - `port` (`number`): The port to the page to run the check against. Will be combined with host (specified within the 'monitored_resource') to construct the full URL.
+  - `ping_config` (`list[obj]`): Contains information needed to add pings to a TCP check. When `null`, the `ping_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_uptime_check_config.tcp_check.ping_config.new](#fn-tcp_checkping_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `tcp_check` sub block.
 
 
+## obj tcp_check.ping_config
+
+
+
+### fn tcp_check.ping_config.new
+
+```ts
+new()
+```
+
+
+`google.monitoring_uptime_check_config.tcp_check.ping_config.new` constructs a new object with attributes and blocks configured for the `ping_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pings_count` (`number`): Number of ICMP pings. A maximum of 3 ICMP pings is currently supported.
+
+**Returns**:
+  - An attribute object that represents the `ping_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/netapp_active_directory.md b/docs/4.x/netapp_active_directory.md
new file mode 100644
index 00000000..da1194fa
--- /dev/null
+++ b/docs/4.x/netapp_active_directory.md
@@ -0,0 +1,538 @@
+---
+permalink: /netapp_active_directory/
+---
+
+# netapp_active_directory
+
+`netapp_active_directory` represents the `google_netapp_active_directory` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAesEncryption()`](#fn-withaesencryption)
+* [`fn withBackupOperators()`](#fn-withbackupoperators)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDns()`](#fn-withdns)
+* [`fn withDomain()`](#fn-withdomain)
+* [`fn withEncryptDcConnections()`](#fn-withencryptdcconnections)
+* [`fn withKdcHostname()`](#fn-withkdchostname)
+* [`fn withKdcIp()`](#fn-withkdcip)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLdapSigning()`](#fn-withldapsigning)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetBiosPrefix()`](#fn-withnetbiosprefix)
+* [`fn withNfsUsersWithLdap()`](#fn-withnfsuserswithldap)
+* [`fn withOrganizationalUnit()`](#fn-withorganizationalunit)
+* [`fn withPassword()`](#fn-withpassword)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withSecurityOperators()`](#fn-withsecurityoperators)
+* [`fn withSite()`](#fn-withsite)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUsername()`](#fn-withusername)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.netapp_active_directory.new` injects a new `google_netapp_active_directory` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.netapp_active_directory.new('some_id')
+
+You can get the reference to the `id` field of the created `google.netapp_active_directory` using the reference:
+
+    $._ref.google_netapp_active_directory.some_id.get('id')
+
+This is the same as directly entering `"${ google_netapp_active_directory.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `aes_encryption` (`bool`): Enables AES-128 and AES-256 encryption for Kerberos-based communication with Active Directory. When `null`, the `aes_encryption` field will be omitted from the resulting object.
+  - `backup_operators` (`list`): Domain user/group accounts to be added to the Backup Operators group of the SMB service. The Backup Operators group allows members to backup and restore files regardless of whether they have read or write access to the files. Comma-separated list. When `null`, the `backup_operators` field will be omitted from the resulting object.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `dns` (`string`): Comma separated list of DNS server IP addresses for the Active Directory domain.
+  - `domain` (`string`): Fully qualified domain name for the Active Directory domain.
+  - `encrypt_dc_connections` (`bool`): If enabled, traffic between the SMB server to Domain Controller (DC) will be encrypted. When `null`, the `encrypt_dc_connections` field will be omitted from the resulting object.
+  - `kdc_hostname` (`string`): Hostname of the Active Directory server used as Kerberos Key Distribution Center. Only requried for volumes using kerberized NFSv4.1 When `null`, the `kdc_hostname` field will be omitted from the resulting object.
+  - `kdc_ip` (`string`): IP address of the Active Directory server used as Kerberos Key Distribution Center. When `null`, the `kdc_ip` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `ldap_signing` (`bool`): Specifies whether or not the LDAP traffic needs to be signed. When `null`, the `ldap_signing` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the region for the policy to apply to.
+  - `name` (`string`): The resource name of the Active Directory pool. Needs to be unique per location.
+  - `net_bios_prefix` (`string`): NetBIOS name prefix of the server to be created.
+A five-character random ID is generated automatically, for example, -6f9a, and appended to the prefix. The full UNC share path will have the following format:
+'\\NetBIOS_PREFIX-ABCD.DOMAIN_NAME\SHARE_NAME'
+  - `nfs_users_with_ldap` (`bool`): Local UNIX users on clients without valid user information in Active Directory are blocked from access to LDAP enabled volumes.
+This option can be used to temporarily switch such volumes to AUTH_SYS authentication (user ID + 1-16 groups). When `null`, the `nfs_users_with_ldap` field will be omitted from the resulting object.
+  - `organizational_unit` (`string`): Name of the Organizational Unit where you intend to create the computer account for NetApp Volumes.
+Defaults to 'CN=Computers' if left empty. When `null`, the `organizational_unit` field will be omitted from the resulting object.
+  - `password` (`string`): Password for specified username. Note - Manual changes done to the password will not be detected. Terraform will not re-apply the password, unless you use a new password in Terraform.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `security_operators` (`list`): Domain accounts that require elevated privileges such as 'SeSecurityPrivilege' to manage security logs. Comma-separated list. When `null`, the `security_operators` field will be omitted from the resulting object.
+  - `site` (`string`): Specifies an Active Directory site to manage domain controller selection.
+Use when Active Directory domain controllers in multiple regions are configured. Defaults to 'Default-First-Site-Name' if left empty. When `null`, the `site` field will be omitted from the resulting object.
+  - `username` (`string`): Username for the Active Directory account with permissions to create the compute account within the specified organizational unit.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_active_directory.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.netapp_active_directory.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_active_directory`
+Terraform resource.
+
+Unlike [google.netapp_active_directory.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `aes_encryption` (`bool`): Enables AES-128 and AES-256 encryption for Kerberos-based communication with Active Directory. When `null`, the `aes_encryption` field will be omitted from the resulting object.
+  - `backup_operators` (`list`): Domain user/group accounts to be added to the Backup Operators group of the SMB service. The Backup Operators group allows members to backup and restore files regardless of whether they have read or write access to the files. Comma-separated list. When `null`, the `backup_operators` field will be omitted from the resulting object.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `dns` (`string`): Comma separated list of DNS server IP addresses for the Active Directory domain.
+  - `domain` (`string`): Fully qualified domain name for the Active Directory domain.
+  - `encrypt_dc_connections` (`bool`): If enabled, traffic between the SMB server to Domain Controller (DC) will be encrypted. When `null`, the `encrypt_dc_connections` field will be omitted from the resulting object.
+  - `kdc_hostname` (`string`): Hostname of the Active Directory server used as Kerberos Key Distribution Center. Only requried for volumes using kerberized NFSv4.1 When `null`, the `kdc_hostname` field will be omitted from the resulting object.
+  - `kdc_ip` (`string`): IP address of the Active Directory server used as Kerberos Key Distribution Center. When `null`, the `kdc_ip` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `ldap_signing` (`bool`): Specifies whether or not the LDAP traffic needs to be signed. When `null`, the `ldap_signing` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the region for the policy to apply to.
+  - `name` (`string`): The resource name of the Active Directory pool. Needs to be unique per location.
+  - `net_bios_prefix` (`string`): NetBIOS name prefix of the server to be created.
+A five-character random ID is generated automatically, for example, -6f9a, and appended to the prefix. The full UNC share path will have the following format:
+'\\NetBIOS_PREFIX-ABCD.DOMAIN_NAME\SHARE_NAME'
+  - `nfs_users_with_ldap` (`bool`): Local UNIX users on clients without valid user information in Active Directory are blocked from access to LDAP enabled volumes.
+This option can be used to temporarily switch such volumes to AUTH_SYS authentication (user ID + 1-16 groups). When `null`, the `nfs_users_with_ldap` field will be omitted from the resulting object.
+  - `organizational_unit` (`string`): Name of the Organizational Unit where you intend to create the computer account for NetApp Volumes.
+Defaults to 'CN=Computers' if left empty. When `null`, the `organizational_unit` field will be omitted from the resulting object.
+  - `password` (`string`): Password for specified username. Note - Manual changes done to the password will not be detected. Terraform will not re-apply the password, unless you use a new password in Terraform.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `security_operators` (`list`): Domain accounts that require elevated privileges such as 'SeSecurityPrivilege' to manage security logs. Comma-separated list. When `null`, the `security_operators` field will be omitted from the resulting object.
+  - `site` (`string`): Specifies an Active Directory site to manage domain controller selection.
+Use when Active Directory domain controllers in multiple regions are configured. Defaults to 'Default-First-Site-Name' if left empty. When `null`, the `site` field will be omitted from the resulting object.
+  - `username` (`string`): Username for the Active Directory account with permissions to create the compute account within the specified organizational unit.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_active_directory.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_active_directory` resource into the root Terraform configuration.
+
+
+### fn withAesEncryption
+
+```ts
+withAesEncryption()
+```
+
+`google.bool.withAesEncryption` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the aes_encryption field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `aes_encryption` field.
+
+
+### fn withBackupOperators
+
+```ts
+withBackupOperators()
+```
+
+`google.list.withBackupOperators` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the backup_operators field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `backup_operators` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDns
+
+```ts
+withDns()
+```
+
+`google.string.withDns` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the dns field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `dns` field.
+
+
+### fn withDomain
+
+```ts
+withDomain()
+```
+
+`google.string.withDomain` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the domain field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `domain` field.
+
+
+### fn withEncryptDcConnections
+
+```ts
+withEncryptDcConnections()
+```
+
+`google.bool.withEncryptDcConnections` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the encrypt_dc_connections field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `encrypt_dc_connections` field.
+
+
+### fn withKdcHostname
+
+```ts
+withKdcHostname()
+```
+
+`google.string.withKdcHostname` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kdc_hostname field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kdc_hostname` field.
+
+
+### fn withKdcIp
+
+```ts
+withKdcIp()
+```
+
+`google.string.withKdcIp` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kdc_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kdc_ip` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLdapSigning
+
+```ts
+withLdapSigning()
+```
+
+`google.bool.withLdapSigning` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the ldap_signing field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `ldap_signing` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetBiosPrefix
+
+```ts
+withNetBiosPrefix()
+```
+
+`google.string.withNetBiosPrefix` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the net_bios_prefix field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `net_bios_prefix` field.
+
+
+### fn withNfsUsersWithLdap
+
+```ts
+withNfsUsersWithLdap()
+```
+
+`google.bool.withNfsUsersWithLdap` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the nfs_users_with_ldap field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `nfs_users_with_ldap` field.
+
+
+### fn withOrganizationalUnit
+
+```ts
+withOrganizationalUnit()
+```
+
+`google.string.withOrganizationalUnit` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the organizational_unit field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `organizational_unit` field.
+
+
+### fn withPassword
+
+```ts
+withPassword()
+```
+
+`google.string.withPassword` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the password field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `password` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withSecurityOperators
+
+```ts
+withSecurityOperators()
+```
+
+`google.list.withSecurityOperators` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the security_operators field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `security_operators` field.
+
+
+### fn withSite
+
+```ts
+withSite()
+```
+
+`google.string.withSite` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the site field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `site` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUsername
+
+```ts
+withUsername()
+```
+
+`google.string.withUsername` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the username field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `username` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.netapp_active_directory.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/netapp_backup_policy.md b/docs/4.x/netapp_backup_policy.md
new file mode 100644
index 00000000..a8a7353e
--- /dev/null
+++ b/docs/4.x/netapp_backup_policy.md
@@ -0,0 +1,321 @@
+---
+permalink: /netapp_backup_policy/
+---
+
+# netapp_backup_policy
+
+`netapp_backup_policy` represents the `google_netapp_backup_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDailyBackupLimit()`](#fn-withdailybackuplimit)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withEnabled()`](#fn-withenabled)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMonthlyBackupLimit()`](#fn-withmonthlybackuplimit)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withWeeklyBackupLimit()`](#fn-withweeklybackuplimit)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.netapp_backup_policy.new` injects a new `google_netapp_backup_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.netapp_backup_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.netapp_backup_policy` using the reference:
+
+    $._ref.google_netapp_backup_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_netapp_backup_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `daily_backup_limit` (`number`): Number of daily backups to keep. Note that the minimum daily backup limit is 2.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `enabled` (`bool`): If enabled, make backups automatically according to the schedules.
+This will be applied to all volumes that have this policy attached and enforced on volume level. When `null`, the `enabled` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the region for the policy to apply to.
+  - `monthly_backup_limit` (`number`): Number of monthly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.
+  - `name` (`string`): The name of the backup policy. Needs to be unique per location.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `weekly_backup_limit` (`number`): Number of weekly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.netapp_backup_policy.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_backup_policy`
+Terraform resource.
+
+Unlike [google.netapp_backup_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `daily_backup_limit` (`number`): Number of daily backups to keep. Note that the minimum daily backup limit is 2.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `enabled` (`bool`): If enabled, make backups automatically according to the schedules.
+This will be applied to all volumes that have this policy attached and enforced on volume level. When `null`, the `enabled` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the region for the policy to apply to.
+  - `monthly_backup_limit` (`number`): Number of monthly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.
+  - `name` (`string`): The name of the backup policy. Needs to be unique per location.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `weekly_backup_limit` (`number`): Number of weekly backups to keep. Note that the sum of daily, weekly and monthly backups should be greater than 1.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_backup_policy` resource into the root Terraform configuration.
+
+
+### fn withDailyBackupLimit
+
+```ts
+withDailyBackupLimit()
+```
+
+`google.number.withDailyBackupLimit` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the daily_backup_limit field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `daily_backup_limit` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withEnabled
+
+```ts
+withEnabled()
+```
+
+`google.bool.withEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enabled` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMonthlyBackupLimit
+
+```ts
+withMonthlyBackupLimit()
+```
+
+`google.number.withMonthlyBackupLimit` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the monthly_backup_limit field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `monthly_backup_limit` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withWeeklyBackupLimit
+
+```ts
+withWeeklyBackupLimit()
+```
+
+`google.number.withWeeklyBackupLimit` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the weekly_backup_limit field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `weekly_backup_limit` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.netapp_backup_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_game_server_deployment.md b/docs/4.x/netapp_backup_vault.md
similarity index 65%
rename from docs/4.x/game_services_game_server_deployment.md
rename to docs/4.x/netapp_backup_vault.md
index bc1b3247..d4ac7be1 100644
--- a/docs/4.x/game_services_game_server_deployment.md
+++ b/docs/4.x/netapp_backup_vault.md
@@ -1,10 +1,10 @@
 ---
-permalink: /game_services_game_server_deployment/
+permalink: /netapp_backup_vault/
 ---
 
-# game_services_game_server_deployment
+# netapp_backup_vault
 
-`game_services_game_server_deployment` represents the `google_game_services_game_server_deployment` Terraform resource.
+`netapp_backup_vault` represents the `google_netapp_backup_vault` Terraform resource.
 
 
 
@@ -15,10 +15,10 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
@@ -34,33 +34,36 @@ new()
 ```
 
 
-`google.game_services_game_server_deployment.new` injects a new `google_game_services_game_server_deployment` Terraform `resource`
+`google.netapp_backup_vault.new` injects a new `google_netapp_backup_vault` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.game_services_game_server_deployment.new('some_id')
+    google.netapp_backup_vault.new('some_id')
 
-You can get the reference to the `id` field of the created `google.game_services_game_server_deployment` using the reference:
+You can get the reference to the `id` field of the created `google.netapp_backup_vault` using the reference:
 
-    $._ref.google_game_services_game_server_deployment.some_id.get('id')
+    $._ref.google_netapp_backup_vault.some_id.get('id')
 
-This is the same as directly entering `"${ google_game_services_game_server_deployment.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_netapp_backup_vault.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location (region) of the backup vault.
+  - `name` (`string`): The resource name of the backup vault. Needs to be unique per location.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_vault.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -73,10 +76,10 @@ newAttrs()
 ```
 
 
-`google.game_services_game_server_deployment.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment`
+`google.netapp_backup_vault.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_backup_vault`
 Terraform resource.
 
-Unlike [google.game_services_game_server_deployment.new](#fn-new), this function will not inject the `resource`
+Unlike [google.netapp_backup_vault.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -84,32 +87,19 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment` resource into the root Terraform configuration.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the deployment_id field.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
 
 
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location (region) of the backup vault.
+  - `name` (`string`): The resource name of the backup vault. Needs to be unique per location.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_backup_vault.timeouts.new](#fn-timeoutsnew) constructor.
 
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_backup_vault` resource into the root Terraform configuration.
 
 
 ### fn withDescription
@@ -160,6 +150,22 @@ Terraform resource block to set or update the location field.
   - `value` (`string`): The value to set for the `location` field.
 
 
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
 ### fn withProject
 
 ```ts
@@ -223,7 +229,7 @@ new()
 ```
 
 
-`google.game_services_game_server_deployment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+`google.netapp_backup_vault.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
 Terraform sub block.
 
 
diff --git a/docs/4.x/netapp_kmsconfig.md b/docs/4.x/netapp_kmsconfig.md
new file mode 100644
index 00000000..e34394b4
--- /dev/null
+++ b/docs/4.x/netapp_kmsconfig.md
@@ -0,0 +1,262 @@
+---
+permalink: /netapp_kmsconfig/
+---
+
+# netapp_kmsconfig
+
+`netapp_kmsconfig` represents the `google_netapp_kmsconfig` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCryptoKeyName()`](#fn-withcryptokeyname)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.netapp_kmsconfig.new` injects a new `google_netapp_kmsconfig` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.netapp_kmsconfig.new('some_id')
+
+You can get the reference to the `id` field of the created `google.netapp_kmsconfig` using the reference:
+
+    $._ref.google_netapp_kmsconfig.some_id.get('id')
+
+This is the same as directly entering `"${ google_netapp_kmsconfig.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `crypto_key_name` (`string`): Resource name of the KMS key to use. Only regional keys are supported. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{key_ring}}/cryptoKeys/{{key}}'.
+  - `description` (`string`): Description for the CMEK policy. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the policy location. CMEK policies apply to the whole region.
+  - `name` (`string`): Name of the CMEK policy.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_kmsconfig.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.netapp_kmsconfig.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_kmsconfig`
+Terraform resource.
+
+Unlike [google.netapp_kmsconfig.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `crypto_key_name` (`string`): Resource name of the KMS key to use. Only regional keys are supported. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{key_ring}}/cryptoKeys/{{key}}'.
+  - `description` (`string`): Description for the CMEK policy. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the policy location. CMEK policies apply to the whole region.
+  - `name` (`string`): Name of the CMEK policy.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_kmsconfig.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_kmsconfig` resource into the root Terraform configuration.
+
+
+### fn withCryptoKeyName
+
+```ts
+withCryptoKeyName()
+```
+
+`google.string.withCryptoKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the crypto_key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `crypto_key_name` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.netapp_kmsconfig.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/netapp_storage_pool.md b/docs/4.x/netapp_storage_pool.md
new file mode 100644
index 00000000..f198f16b
--- /dev/null
+++ b/docs/4.x/netapp_storage_pool.md
@@ -0,0 +1,363 @@
+---
+permalink: /netapp_storage_pool/
+---
+
+# netapp_storage_pool
+
+`netapp_storage_pool` represents the `google_netapp_storage_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withActiveDirectory()`](#fn-withactivedirectory)
+* [`fn withCapacityGib()`](#fn-withcapacitygib)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withKmsConfig()`](#fn-withkmsconfig)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLdapEnabled()`](#fn-withldapenabled)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetwork()`](#fn-withnetwork)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withServiceLevel()`](#fn-withservicelevel)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.netapp_storage_pool.new` injects a new `google_netapp_storage_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.netapp_storage_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.netapp_storage_pool` using the reference:
+
+    $._ref.google_netapp_storage_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_netapp_storage_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `active_directory` (`string`): Specifies the Active Directory policy to be used. Format: 'projects/{{project}}/locations/{{location}}/activeDirectories/{{name}}'.
+The policy needs to be in the same location as the storage pool. When `null`, the `active_directory` field will be omitted from the resulting object.
+  - `capacity_gib` (`string`): Capacity of the storage pool (in GiB).
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `kms_config` (`string`): Specifies the CMEK policy to be used for volume encryption. Format: 'projects/{{project}}/locations/{{location}}/kmsConfigs/{{name}}'.
+The policy needs to be in the same location as the storage pool. When `null`, the `kms_config` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `ldap_enabled` (`bool`): When enabled, the volumes uses Active Directory as LDAP name service for UID/GID lookups. Required to enable extended group support for NFSv3,
+using security identifiers for NFSv4.1 or principal names for kerberized NFSv4.1. When `null`, the `ldap_enabled` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the location. Usually a region name, expect for some STANDARD service level pools which require a zone name.
+  - `name` (`string`): The resource name of the storage pool. Needs to be unique per location.
+  - `network` (`string`): VPC network name with format: 'projects/{{project}}/global/networks/{{network}}'
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `service_level` (`string`): Service level of the storage pool. Possible values: ["PREMIUM", "EXTREME", "STANDARD"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_storage_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.netapp_storage_pool.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_storage_pool`
+Terraform resource.
+
+Unlike [google.netapp_storage_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `active_directory` (`string`): Specifies the Active Directory policy to be used. Format: 'projects/{{project}}/locations/{{location}}/activeDirectories/{{name}}'.
+The policy needs to be in the same location as the storage pool. When `null`, the `active_directory` field will be omitted from the resulting object.
+  - `capacity_gib` (`string`): Capacity of the storage pool (in GiB).
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `kms_config` (`string`): Specifies the CMEK policy to be used for volume encryption. Format: 'projects/{{project}}/locations/{{location}}/kmsConfigs/{{name}}'.
+The policy needs to be in the same location as the storage pool. When `null`, the `kms_config` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `ldap_enabled` (`bool`): When enabled, the volumes uses Active Directory as LDAP name service for UID/GID lookups. Required to enable extended group support for NFSv3,
+using security identifiers for NFSv4.1 or principal names for kerberized NFSv4.1. When `null`, the `ldap_enabled` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the location. Usually a region name, expect for some STANDARD service level pools which require a zone name.
+  - `name` (`string`): The resource name of the storage pool. Needs to be unique per location.
+  - `network` (`string`): VPC network name with format: 'projects/{{project}}/global/networks/{{network}}'
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `service_level` (`string`): Service level of the storage pool. Possible values: ["PREMIUM", "EXTREME", "STANDARD"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_storage_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_storage_pool` resource into the root Terraform configuration.
+
+
+### fn withActiveDirectory
+
+```ts
+withActiveDirectory()
+```
+
+`google.string.withActiveDirectory` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the active_directory field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `active_directory` field.
+
+
+### fn withCapacityGib
+
+```ts
+withCapacityGib()
+```
+
+`google.string.withCapacityGib` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the capacity_gib field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `capacity_gib` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withKmsConfig
+
+```ts
+withKmsConfig()
+```
+
+`google.string.withKmsConfig` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kms_config field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kms_config` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLdapEnabled
+
+```ts
+withLdapEnabled()
+```
+
+`google.bool.withLdapEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the ldap_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `ldap_enabled` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetwork
+
+```ts
+withNetwork()
+```
+
+`google.string.withNetwork` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the network field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `network` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withServiceLevel
+
+```ts
+withServiceLevel()
+```
+
+`google.string.withServiceLevel` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the service_level field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `service_level` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.netapp_storage_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/netapp_volume.md b/docs/4.x/netapp_volume.md
new file mode 100644
index 00000000..82ab5118
--- /dev/null
+++ b/docs/4.x/netapp_volume.md
@@ -0,0 +1,741 @@
+---
+permalink: /netapp_volume/
+---
+
+# netapp_volume
+
+`netapp_volume` represents the `google_netapp_volume` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCapacityGib()`](#fn-withcapacitygib)
+* [`fn withDeletionPolicy()`](#fn-withdeletionpolicy)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withExportPolicy()`](#fn-withexportpolicy)
+* [`fn withExportPolicyMixin()`](#fn-withexportpolicymixin)
+* [`fn withKerberosEnabled()`](#fn-withkerberosenabled)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withProtocols()`](#fn-withprotocols)
+* [`fn withRestrictedActions()`](#fn-withrestrictedactions)
+* [`fn withSecurityStyle()`](#fn-withsecuritystyle)
+* [`fn withShareName()`](#fn-withsharename)
+* [`fn withSmbSettings()`](#fn-withsmbsettings)
+* [`fn withSnapshotDirectory()`](#fn-withsnapshotdirectory)
+* [`fn withSnapshotPolicy()`](#fn-withsnapshotpolicy)
+* [`fn withSnapshotPolicyMixin()`](#fn-withsnapshotpolicymixin)
+* [`fn withStoragePool()`](#fn-withstoragepool)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUnixPermissions()`](#fn-withunixpermissions)
+* [`obj export_policy`](#obj-export_policy)
+  * [`fn new()`](#fn-export_policynew)
+  * [`obj export_policy.rules`](#obj-export_policyrules)
+    * [`fn new()`](#fn-export_policyrulesnew)
+* [`obj snapshot_policy`](#obj-snapshot_policy)
+  * [`fn new()`](#fn-snapshot_policynew)
+  * [`obj snapshot_policy.daily_schedule`](#obj-snapshot_policydaily_schedule)
+    * [`fn new()`](#fn-snapshot_policydaily_schedulenew)
+  * [`obj snapshot_policy.hourly_schedule`](#obj-snapshot_policyhourly_schedule)
+    * [`fn new()`](#fn-snapshot_policyhourly_schedulenew)
+  * [`obj snapshot_policy.monthly_schedule`](#obj-snapshot_policymonthly_schedule)
+    * [`fn new()`](#fn-snapshot_policymonthly_schedulenew)
+  * [`obj snapshot_policy.weekly_schedule`](#obj-snapshot_policyweekly_schedule)
+    * [`fn new()`](#fn-snapshot_policyweekly_schedulenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.new` injects a new `google_netapp_volume` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.netapp_volume.new('some_id')
+
+You can get the reference to the `id` field of the created `google.netapp_volume` using the reference:
+
+    $._ref.google_netapp_volume.some_id.get('id')
+
+This is the same as directly entering `"${ google_netapp_volume.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `capacity_gib` (`string`): Capacity of the volume (in GiB).
+  - `deletion_policy` (`string`): Policy to determine if the volume should be deleted forcefully.
+Volumes may have nested snapshot resources. Deleting such a volume will fail.
+Setting this parameter to FORCE will delete volumes including nested snapshots. When `null`, the `deletion_policy` field will be omitted from the resulting object.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `kerberos_enabled` (`bool`): Flag indicating if the volume is a kerberos volume or not, export policy rules control kerberos security modes (krb5, krb5i, krb5p). When `null`, the `kerberos_enabled` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the pool location. Usually a region name, expect for some STANDARD service level pools which require a zone name.
+  - `name` (`string`): The name of the volume. Needs to be unique per location.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `protocols` (`list`): The protocol of the volume. Allowed combinations are '['NFSV3']', '['NFSV4']', '['SMB']', '['NFSV3', 'NFSV4']', '['SMB', 'NFSV3']' and '['SMB', 'NFSV4']'. Possible values: ["NFSV3", "NFSV4", "SMB"]
+  - `restricted_actions` (`list`): List of actions that are restricted on this volume. Possible values: ["DELETE"] When `null`, the `restricted_actions` field will be omitted from the resulting object.
+  - `security_style` (`string`): Security Style of the Volume. Use UNIX to use UNIX or NFSV4 ACLs for file permissions.
+Use NTFS to use NTFS ACLs for file permissions. Can only be set for volumes which use SMB together with NFS as protocol. Possible values: ["NTFS", "UNIX"] When `null`, the `security_style` field will be omitted from the resulting object.
+  - `share_name` (`string`): Share name (SMB) or export path (NFS) of the volume. Needs to be unique per location.
+  - `smb_settings` (`list`): Settings for volumes with SMB access. Possible values: ["ENCRYPT_DATA", "BROWSABLE", "CHANGE_NOTIFY", "NON_BROWSABLE", "OPLOCKS", "SHOW_SNAPSHOT", "SHOW_PREVIOUS_VERSIONS", "ACCESS_BASED_ENUMERATION", "CONTINUOUSLY_AVAILABLE"] When `null`, the `smb_settings` field will be omitted from the resulting object.
+  - `snapshot_directory` (`bool`): If enabled, a NFS volume will contain a read-only .snapshot directory which provides access to each of the volume's snapshots. Will enable "Previous Versions" support for SMB. When `null`, the `snapshot_directory` field will be omitted from the resulting object.
+  - `storage_pool` (`string`): Name of the storage pool to create the volume in. Pool needs enough spare capacity to accomodate the volume.
+  - `unix_permissions` (`string`): Unix permission the mount point will be created with. Default is 0770. Applicable for UNIX security style volumes only. When `null`, the `unix_permissions` field will be omitted from the resulting object.
+  - `export_policy` (`list[obj]`): Export policy of the volume for NFSV3 and/or NFSV4.1 access. When `null`, the `export_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.export_policy.new](#fn-export_policynew) constructor.
+  - `snapshot_policy` (`list[obj]`): Snapshot policy defines the schedule for automatic snapshot creation.
+To disable automatic snapshot creation you have to remove the whole snapshot_policy block. When `null`, the `snapshot_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.new](#fn-snapshot_policynew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.netapp_volume.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_volume`
+Terraform resource.
+
+Unlike [google.netapp_volume.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `capacity_gib` (`string`): Capacity of the volume (in GiB).
+  - `deletion_policy` (`string`): Policy to determine if the volume should be deleted forcefully.
+Volumes may have nested snapshot resources. Deleting such a volume will fail.
+Setting this parameter to FORCE will delete volumes including nested snapshots. When `null`, the `deletion_policy` field will be omitted from the resulting object.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `kerberos_enabled` (`bool`): Flag indicating if the volume is a kerberos volume or not, export policy rules control kerberos security modes (krb5, krb5i, krb5p). When `null`, the `kerberos_enabled` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the pool location. Usually a region name, expect for some STANDARD service level pools which require a zone name.
+  - `name` (`string`): The name of the volume. Needs to be unique per location.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `protocols` (`list`): The protocol of the volume. Allowed combinations are '['NFSV3']', '['NFSV4']', '['SMB']', '['NFSV3', 'NFSV4']', '['SMB', 'NFSV3']' and '['SMB', 'NFSV4']'. Possible values: ["NFSV3", "NFSV4", "SMB"]
+  - `restricted_actions` (`list`): List of actions that are restricted on this volume. Possible values: ["DELETE"] When `null`, the `restricted_actions` field will be omitted from the resulting object.
+  - `security_style` (`string`): Security Style of the Volume. Use UNIX to use UNIX or NFSV4 ACLs for file permissions.
+Use NTFS to use NTFS ACLs for file permissions. Can only be set for volumes which use SMB together with NFS as protocol. Possible values: ["NTFS", "UNIX"] When `null`, the `security_style` field will be omitted from the resulting object.
+  - `share_name` (`string`): Share name (SMB) or export path (NFS) of the volume. Needs to be unique per location.
+  - `smb_settings` (`list`): Settings for volumes with SMB access. Possible values: ["ENCRYPT_DATA", "BROWSABLE", "CHANGE_NOTIFY", "NON_BROWSABLE", "OPLOCKS", "SHOW_SNAPSHOT", "SHOW_PREVIOUS_VERSIONS", "ACCESS_BASED_ENUMERATION", "CONTINUOUSLY_AVAILABLE"] When `null`, the `smb_settings` field will be omitted from the resulting object.
+  - `snapshot_directory` (`bool`): If enabled, a NFS volume will contain a read-only .snapshot directory which provides access to each of the volume's snapshots. Will enable "Previous Versions" support for SMB. When `null`, the `snapshot_directory` field will be omitted from the resulting object.
+  - `storage_pool` (`string`): Name of the storage pool to create the volume in. Pool needs enough spare capacity to accomodate the volume.
+  - `unix_permissions` (`string`): Unix permission the mount point will be created with. Default is 0770. Applicable for UNIX security style volumes only. When `null`, the `unix_permissions` field will be omitted from the resulting object.
+  - `export_policy` (`list[obj]`): Export policy of the volume for NFSV3 and/or NFSV4.1 access. When `null`, the `export_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.export_policy.new](#fn-export_policynew) constructor.
+  - `snapshot_policy` (`list[obj]`): Snapshot policy defines the schedule for automatic snapshot creation.
+To disable automatic snapshot creation you have to remove the whole snapshot_policy block. When `null`, the `snapshot_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.new](#fn-snapshot_policynew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_volume` resource into the root Terraform configuration.
+
+
+### fn withCapacityGib
+
+```ts
+withCapacityGib()
+```
+
+`google.string.withCapacityGib` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the capacity_gib field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `capacity_gib` field.
+
+
+### fn withDeletionPolicy
+
+```ts
+withDeletionPolicy()
+```
+
+`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the deletion_policy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `deletion_policy` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withExportPolicy
+
+```ts
+withExportPolicy()
+```
+
+`google.list[obj].withExportPolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the export_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withExportPolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `export_policy` field.
+
+
+### fn withExportPolicyMixin
+
+```ts
+withExportPolicyMixin()
+```
+
+`google.list[obj].withExportPolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the export_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withExportPolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `export_policy` field.
+
+
+### fn withKerberosEnabled
+
+```ts
+withKerberosEnabled()
+```
+
+`google.bool.withKerberosEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the kerberos_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `kerberos_enabled` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withProtocols
+
+```ts
+withProtocols()
+```
+
+`google.list.withProtocols` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the protocols field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `protocols` field.
+
+
+### fn withRestrictedActions
+
+```ts
+withRestrictedActions()
+```
+
+`google.list.withRestrictedActions` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the restricted_actions field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `restricted_actions` field.
+
+
+### fn withSecurityStyle
+
+```ts
+withSecurityStyle()
+```
+
+`google.string.withSecurityStyle` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the security_style field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `security_style` field.
+
+
+### fn withShareName
+
+```ts
+withShareName()
+```
+
+`google.string.withShareName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the share_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `share_name` field.
+
+
+### fn withSmbSettings
+
+```ts
+withSmbSettings()
+```
+
+`google.list.withSmbSettings` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the smb_settings field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `smb_settings` field.
+
+
+### fn withSnapshotDirectory
+
+```ts
+withSnapshotDirectory()
+```
+
+`google.bool.withSnapshotDirectory` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the snapshot_directory field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `snapshot_directory` field.
+
+
+### fn withSnapshotPolicy
+
+```ts
+withSnapshotPolicy()
+```
+
+`google.list[obj].withSnapshotPolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the snapshot_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSnapshotPolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `snapshot_policy` field.
+
+
+### fn withSnapshotPolicyMixin
+
+```ts
+withSnapshotPolicyMixin()
+```
+
+`google.list[obj].withSnapshotPolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the snapshot_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSnapshotPolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `snapshot_policy` field.
+
+
+### fn withStoragePool
+
+```ts
+withStoragePool()
+```
+
+`google.string.withStoragePool` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the storage_pool field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `storage_pool` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUnixPermissions
+
+```ts
+withUnixPermissions()
+```
+
+`google.string.withUnixPermissions` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the unix_permissions field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `unix_permissions` field.
+
+
+## obj export_policy
+
+
+
+### fn export_policy.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.export_policy.new` constructs a new object with attributes and blocks configured for the `export_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `rules` (`list[obj]`): Export rules (up to 5) control NFS volume access. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.export_policy.rules.new](#fn-export_policyrulesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `export_policy` sub block.
+
+
+## obj export_policy.rules
+
+
+
+### fn export_policy.rules.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.export_policy.rules.new` constructs a new object with attributes and blocks configured for the `rules`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_type` (`string`): Defines the access type for clients matching the 'allowedClients' specification. Possible values: ["READ_ONLY", "READ_WRITE", "READ_NONE"] When `null`, the `access_type` field will be omitted from the resulting object.
+  - `allowed_clients` (`string`): Defines the client ingress specification (allowed clients) as a comma seperated list with IPv4 CIDRs or IPv4 host addresses. When `null`, the `allowed_clients` field will be omitted from the resulting object.
+  - `has_root_access` (`string`): If enabled, the root user (UID = 0) of the specified clients doesn't get mapped to nobody (UID = 65534). This is also known as no_root_squash. When `null`, the `has_root_access` field will be omitted from the resulting object.
+  - `kerberos5_read_only` (`bool`): If enabled (true) the rule defines a read only access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'authentication' kerberos security mode. When `null`, the `kerberos5_read_only` field will be omitted from the resulting object.
+  - `kerberos5_read_write` (`bool`): If enabled (true) the rule defines read and write access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'authentication' kerberos security mode. The 'kerberos5ReadOnly' value is ignored if this is enabled. When `null`, the `kerberos5_read_write` field will be omitted from the resulting object.
+  - `kerberos5i_read_only` (`bool`): If enabled (true) the rule defines a read only access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'integrity' kerberos security mode. When `null`, the `kerberos5i_read_only` field will be omitted from the resulting object.
+  - `kerberos5i_read_write` (`bool`): If enabled (true) the rule defines read and write access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'integrity' kerberos security mode. The 'kerberos5iReadOnly' value is ignored if this is enabled. When `null`, the `kerberos5i_read_write` field will be omitted from the resulting object.
+  - `kerberos5p_read_only` (`bool`): If enabled (true) the rule defines a read only access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'privacy' kerberos security mode. When `null`, the `kerberos5p_read_only` field will be omitted from the resulting object.
+  - `kerberos5p_read_write` (`bool`): If enabled (true) the rule defines read and write access for clients matching the 'allowedClients' specification. It enables nfs clients to mount using 'privacy' kerberos security mode. The 'kerberos5pReadOnly' value is ignored if this is enabled. When `null`, the `kerberos5p_read_write` field will be omitted from the resulting object.
+  - `nfsv3` (`bool`): Enable to apply the export rule to NFSV3 clients. When `null`, the `nfsv3` field will be omitted from the resulting object.
+  - `nfsv4` (`bool`): Enable to apply the export rule to NFSV4.1 clients. When `null`, the `nfsv4` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `rules` sub block.
+
+
+## obj snapshot_policy
+
+
+
+### fn snapshot_policy.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.snapshot_policy.new` constructs a new object with attributes and blocks configured for the `snapshot_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Enables automated snapshot creation according to defined schedule. Default is false.
+To disable automatic snapshot creation you have to remove the whole snapshot_policy block. When `null`, the `enabled` field will be omitted from the resulting object.
+  - `daily_schedule` (`list[obj]`): Daily schedule policy. When `null`, the `daily_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.daily_schedule.new](#fn-snapshot_policydaily_schedulenew) constructor.
+  - `hourly_schedule` (`list[obj]`): Hourly schedule policy. When `null`, the `hourly_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.hourly_schedule.new](#fn-snapshot_policyhourly_schedulenew) constructor.
+  - `monthly_schedule` (`list[obj]`): Monthly schedule policy. When `null`, the `monthly_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.monthly_schedule.new](#fn-snapshot_policymonthly_schedulenew) constructor.
+  - `weekly_schedule` (`list[obj]`): Weekly schedule policy. When `null`, the `weekly_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume.snapshot_policy.weekly_schedule.new](#fn-snapshot_policyweekly_schedulenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `snapshot_policy` sub block.
+
+
+## obj snapshot_policy.daily_schedule
+
+
+
+### fn snapshot_policy.daily_schedule.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.snapshot_policy.daily_schedule.new` constructs a new object with attributes and blocks configured for the `daily_schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hour` (`number`): Set the hour to create the snapshot (0-23), defaults to midnight (0). When `null`, the `hour` field will be omitted from the resulting object.
+  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.
+  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the daily schedule.
+
+**Returns**:
+  - An attribute object that represents the `daily_schedule` sub block.
+
+
+## obj snapshot_policy.hourly_schedule
+
+
+
+### fn snapshot_policy.hourly_schedule.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.snapshot_policy.hourly_schedule.new` constructs a new object with attributes and blocks configured for the `hourly_schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.
+  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the hourly schedule.
+
+**Returns**:
+  - An attribute object that represents the `hourly_schedule` sub block.
+
+
+## obj snapshot_policy.monthly_schedule
+
+
+
+### fn snapshot_policy.monthly_schedule.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.snapshot_policy.monthly_schedule.new` constructs a new object with attributes and blocks configured for the `monthly_schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `days_of_month` (`string`): Set the day or days of the month to make a snapshot (1-31). Accepts a comma separated number of days. Defaults to '1'. When `null`, the `days_of_month` field will be omitted from the resulting object.
+  - `hour` (`number`): Set the hour to create the snapshot (0-23), defaults to midnight (0). When `null`, the `hour` field will be omitted from the resulting object.
+  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.
+  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the monthly schedule
+
+**Returns**:
+  - An attribute object that represents the `monthly_schedule` sub block.
+
+
+## obj snapshot_policy.weekly_schedule
+
+
+
+### fn snapshot_policy.weekly_schedule.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.snapshot_policy.weekly_schedule.new` constructs a new object with attributes and blocks configured for the `weekly_schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`string`): Set the day or days of the week to make a snapshot. Accepts a comma separated days of the week. Defaults to 'Sunday'. When `null`, the `day` field will be omitted from the resulting object.
+  - `hour` (`number`): Set the hour to create the snapshot (0-23), defaults to midnight (0). When `null`, the `hour` field will be omitted from the resulting object.
+  - `minute` (`number`): Set the minute of the hour to create the snapshot (0-59), defaults to the top of the hour (0). When `null`, the `minute` field will be omitted from the resulting object.
+  - `snapshots_to_keep` (`number`): The maximum number of snapshots to keep for the weekly schedule.
+
+**Returns**:
+  - An attribute object that represents the `weekly_schedule` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.netapp_volume.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_realm.md b/docs/4.x/netapp_volume_snapshot.md
similarity index 62%
rename from docs/4.x/game_services_realm.md
rename to docs/4.x/netapp_volume_snapshot.md
index 3a11fe9b..af8eaffd 100644
--- a/docs/4.x/game_services_realm.md
+++ b/docs/4.x/netapp_volume_snapshot.md
@@ -1,10 +1,10 @@
 ---
-permalink: /game_services_realm/
+permalink: /netapp_volume_snapshot/
 ---
 
-# game_services_realm
+# netapp_volume_snapshot
 
-`game_services_realm` represents the `google_game_services_realm` Terraform resource.
+`netapp_volume_snapshot` represents the `google_netapp_volume_snapshot` Terraform resource.
 
 
 
@@ -18,11 +18,11 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRealmId()`](#fn-withrealmid)
-* [`fn withTimeZone()`](#fn-withtimezone)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVolumeName()`](#fn-withvolumename)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -35,35 +35,37 @@ new()
 ```
 
 
-`google.game_services_realm.new` injects a new `google_game_services_realm` Terraform `resource`
+`google.netapp_volume_snapshot.new` injects a new `google_netapp_volume_snapshot` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.game_services_realm.new('some_id')
+    google.netapp_volume_snapshot.new('some_id')
 
-You can get the reference to the `id` field of the created `google.game_services_realm` using the reference:
+You can get the reference to the `id` field of the created `google.netapp_volume_snapshot` using the reference:
 
-    $._ref.google_game_services_realm.some_id.get('id')
+    $._ref.google_netapp_volume_snapshot.some_id.get('id')
 
-This is the same as directly entering `"${ google_game_services_realm.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_netapp_volume_snapshot.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.
+  - `description` (`string`): Description for the snapshot. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the snapshot location. Snapshots are child resources of volumes and live in the same location.
+  - `name` (`string`): The name of the snapshot.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): GCP region of the Realm.
-  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of
-this field must be from the IANA time zone database:
-https://www.iana.org/time-zones.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.
+  - `volume_name` (`string`): The name of the volume to create the snapshot in.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume_snapshot.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -76,10 +78,10 @@ newAttrs()
 ```
 
 
-`google.game_services_realm.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_realm`
+`google.netapp_volume_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `netapp_volume_snapshot`
 Terraform resource.
 
-Unlike [google.game_services_realm.new](#fn-new), this function will not inject the `resource`
+Unlike [google.netapp_volume_snapshot.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -87,18 +89,20 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.
+  - `description` (`string`): Description for the snapshot. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs. Example: '{ "owner": "Bob", "department": "finance", "purpose": "testing" }'.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Name of the snapshot location. Snapshots are child resources of volumes and live in the same location.
+  - `name` (`string`): The name of the snapshot.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): GCP region of the Realm.
-  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of
-this field must be from the IANA time zone database:
-https://www.iana.org/time-zones.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.
+  - `volume_name` (`string`): The name of the volume to create the snapshot in.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.netapp_volume_snapshot.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_realm` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `netapp_volume_snapshot` resource into the root Terraform configuration.
 
 
 ### fn withDescription
@@ -149,52 +153,36 @@ Terraform resource block to set or update the location field.
   - `value` (`string`): The value to set for the `location` field.
 
 
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRealmId
+### fn withName
 
 ```ts
-withRealmId()
+withName()
 ```
 
-`google.string.withRealmId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the realm_id field.
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `realm_id` field.
+  - `value` (`string`): The value to set for the `name` field.
 
 
-### fn withTimeZone
+### fn withProject
 
 ```ts
-withTimeZone()
+withProject()
 ```
 
-`google.string.withTimeZone` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the time_zone field.
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `time_zone` field.
+  - `value` (`string`): The value to set for the `project` field.
 
 
 ### fn withTimeouts
@@ -233,6 +221,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withVolumeName
+
+```ts
+withVolumeName()
+```
+
+`google.string.withVolumeName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the volume_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `volume_name` field.
+
+
 ## obj timeouts
 
 
@@ -244,7 +248,7 @@ new()
 ```
 
 
-`google.game_services_realm.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+`google.netapp_volume_snapshot.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
 Terraform sub block.
 
 
diff --git a/docs/4.x/network_connectivity_hub.md b/docs/4.x/network_connectivity_hub.md
index efb45595..fdb21768 100644
--- a/docs/4.x/network_connectivity_hub.md
+++ b/docs/4.x/network_connectivity_hub.md
@@ -54,7 +54,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.
@@ -82,7 +85,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/network_connectivity_policy_based_route.md b/docs/4.x/network_connectivity_policy_based_route.md
new file mode 100644
index 00000000..398a66e3
--- /dev/null
+++ b/docs/4.x/network_connectivity_policy_based_route.md
@@ -0,0 +1,501 @@
+---
+permalink: /network_connectivity_policy_based_route/
+---
+
+# network_connectivity_policy_based_route
+
+`network_connectivity_policy_based_route` represents the `google_network_connectivity_policy_based_route` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withFilter()`](#fn-withfilter)
+* [`fn withFilterMixin()`](#fn-withfiltermixin)
+* [`fn withInterconnectAttachment()`](#fn-withinterconnectattachment)
+* [`fn withInterconnectAttachmentMixin()`](#fn-withinterconnectattachmentmixin)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetwork()`](#fn-withnetwork)
+* [`fn withNextHopIlbIp()`](#fn-withnexthopilbip)
+* [`fn withNextHopOtherRoutes()`](#fn-withnexthopotherroutes)
+* [`fn withPriority()`](#fn-withpriority)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVirtualMachine()`](#fn-withvirtualmachine)
+* [`fn withVirtualMachineMixin()`](#fn-withvirtualmachinemixin)
+* [`obj filter`](#obj-filter)
+  * [`fn new()`](#fn-filternew)
+* [`obj interconnect_attachment`](#obj-interconnect_attachment)
+  * [`fn new()`](#fn-interconnect_attachmentnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj virtual_machine`](#obj-virtual_machine)
+  * [`fn new()`](#fn-virtual_machinenew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.new` injects a new `google_network_connectivity_policy_based_route` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.network_connectivity_policy_based_route.new('some_id')
+
+You can get the reference to the `id` field of the created `google.network_connectivity_policy_based_route` using the reference:
+
+    $._ref.google_network_connectivity_policy_based_route.some_id.get('id')
+
+This is the same as directly entering `"${ google_network_connectivity_policy_based_route.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The name of the policy based route.
+  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.
+  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.
+  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: ["DEFAULT_ROUTING"] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.
+  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.
+  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.
+  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.network_connectivity_policy_based_route.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_policy_based_route`
+Terraform resource.
+
+Unlike [google.network_connectivity_policy_based_route.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The name of the policy based route.
+  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.
+  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.
+  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: ["DEFAULT_ROUTING"] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.
+  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.
+  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.
+  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_policy_based_route` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withFilter
+
+```ts
+withFilter()
+```
+
+`google.list[obj].withFilter` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the filter field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withFilterMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `filter` field.
+
+
+### fn withFilterMixin
+
+```ts
+withFilterMixin()
+```
+
+`google.list[obj].withFilterMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the filter field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withFilter](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `filter` field.
+
+
+### fn withInterconnectAttachment
+
+```ts
+withInterconnectAttachment()
+```
+
+`google.list[obj].withInterconnectAttachment` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the interconnect_attachment field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withInterconnectAttachmentMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.
+
+
+### fn withInterconnectAttachmentMixin
+
+```ts
+withInterconnectAttachmentMixin()
+```
+
+`google.list[obj].withInterconnectAttachmentMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the interconnect_attachment field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withInterconnectAttachment](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetwork
+
+```ts
+withNetwork()
+```
+
+`google.string.withNetwork` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the network field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `network` field.
+
+
+### fn withNextHopIlbIp
+
+```ts
+withNextHopIlbIp()
+```
+
+`google.string.withNextHopIlbIp` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the next_hop_ilb_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `next_hop_ilb_ip` field.
+
+
+### fn withNextHopOtherRoutes
+
+```ts
+withNextHopOtherRoutes()
+```
+
+`google.string.withNextHopOtherRoutes` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the next_hop_other_routes field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `next_hop_other_routes` field.
+
+
+### fn withPriority
+
+```ts
+withPriority()
+```
+
+`google.number.withPriority` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the priority field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `priority` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVirtualMachine
+
+```ts
+withVirtualMachine()
+```
+
+`google.list[obj].withVirtualMachine` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the virtual_machine field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVirtualMachineMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.
+
+
+### fn withVirtualMachineMixin
+
+```ts
+withVirtualMachineMixin()
+```
+
+`google.list[obj].withVirtualMachineMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the virtual_machine field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVirtualMachine](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.
+
+
+## obj filter
+
+
+
+### fn filter.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.filter.new` constructs a new object with attributes and blocks configured for the `filter`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dest_range` (`string`): The destination IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `dest_range` field will be omitted from the resulting object.
+  - `ip_protocol` (`string`): The IP protocol that this policy-based route applies to. Valid values are 'TCP', 'UDP', and 'ALL'. Default is 'ALL'. When `null`, the `ip_protocol` field will be omitted from the resulting object.
+  - `protocol_version` (`string`): Internet protocol versions this policy-based route applies to. Possible values: ["IPV4"]
+  - `src_range` (`string`): The source IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `src_range` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `filter` sub block.
+
+
+## obj interconnect_attachment
+
+
+
+### fn interconnect_attachment.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.interconnect_attachment.new` constructs a new object with attributes and blocks configured for the `interconnect_attachment`
+Terraform sub block.
+
+
+
+**Args**:
+  - `region` (`string`): Cloud region to install this policy-based route on for Interconnect attachments. Use 'all' to install it on all Interconnect attachments.
+
+**Returns**:
+  - An attribute object that represents the `interconnect_attachment` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj virtual_machine
+
+
+
+### fn virtual_machine.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.virtual_machine.new` constructs a new object with attributes and blocks configured for the `virtual_machine`
+Terraform sub block.
+
+
+
+**Args**:
+  - `tags` (`list`): A list of VM instance tags that this policy-based route applies to. VM instances that have ANY of tags specified here will install this PBR.
+
+**Returns**:
+  - An attribute object that represents the `virtual_machine` sub block.
diff --git a/docs/4.x/network_connectivity_service_connection_policy.md b/docs/4.x/network_connectivity_service_connection_policy.md
index 71fe1a3d..540e019a 100644
--- a/docs/4.x/network_connectivity_service_connection_policy.md
+++ b/docs/4.x/network_connectivity_service_connection_policy.md
@@ -61,7 +61,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the ServiceConnectionPolicy.
   - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names
   - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.
@@ -94,7 +98,11 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the ServiceConnectionPolicy.
   - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names
   - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.
diff --git a/docs/4.x/network_connectivity_spoke.md b/docs/4.x/network_connectivity_spoke.md
index d8cc8fdb..df6318fa 100644
--- a/docs/4.x/network_connectivity_spoke.md
+++ b/docs/4.x/network_connectivity_spoke.md
@@ -75,7 +75,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.
   - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -109,7 +112,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.
   - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/network_management_connectivity_test.md b/docs/4.x/network_management_connectivity_test.md
index 931ee644..6b381b15 100644
--- a/docs/4.x/network_management_connectivity_test.md
+++ b/docs/4.x/network_management_connectivity_test.md
@@ -65,7 +65,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The user-supplied description of the Connectivity Test.
 Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Unique name for the connectivity test.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.
@@ -139,7 +143,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The user-supplied description of the Connectivity Test.
 Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Unique name for the connectivity test.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.
diff --git a/docs/4.x/network_security_address_group.md b/docs/4.x/network_security_address_group.md
index fec29458..f9a81b14 100644
--- a/docs/4.x/network_security_address_group.md
+++ b/docs/4.x/network_security_address_group.md
@@ -61,7 +61,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway security policy.
 The default value is 'global'.
   - `name` (`string`): Name of the AddressGroup resource.
@@ -95,7 +99,11 @@ injecting into a complete block.
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway security policy.
 The default value is 'global'.
   - `name` (`string`): Name of the AddressGroup resource.
diff --git a/docs/4.x/network_security_address_group_iam_binding.md b/docs/4.x/network_security_address_group_iam_binding.md
new file mode 100644
index 00000000..2a3b9477
--- /dev/null
+++ b/docs/4.x/network_security_address_group_iam_binding.md
@@ -0,0 +1,236 @@
+---
+permalink: /network_security_address_group_iam_binding/
+---
+
+# network_security_address_group_iam_binding
+
+`network_security_address_group_iam_binding` represents the `google_network_security_address_group_iam_binding` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMembers()`](#fn-withmembers)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.network_security_address_group_iam_binding.new` injects a new `google_network_security_address_group_iam_binding` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.network_security_address_group_iam_binding.new('some_id')
+
+You can get the reference to the `id` field of the created `google.network_security_address_group_iam_binding` using the reference:
+
+    $._ref.google_network_security_address_group_iam_binding.some_id.get('id')
+
+This is the same as directly entering `"${ google_network_security_address_group_iam_binding.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `members` (`list`): Set the `members` field on the resulting resource block.
+  - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.network_security_address_group_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_binding`
+Terraform resource.
+
+Unlike [google.network_security_address_group_iam_binding.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `members` (`list`): Set the `members` field on the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group_iam_binding` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMembers
+
+```ts
+withMembers()
+```
+
+`google.list.withMembers` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the members field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `members` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.network_security_address_group_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/network_security_address_group_iam_member.md b/docs/4.x/network_security_address_group_iam_member.md
new file mode 100644
index 00000000..421ee817
--- /dev/null
+++ b/docs/4.x/network_security_address_group_iam_member.md
@@ -0,0 +1,236 @@
+---
+permalink: /network_security_address_group_iam_member/
+---
+
+# network_security_address_group_iam_member
+
+`network_security_address_group_iam_member` represents the `google_network_security_address_group_iam_member` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMember()`](#fn-withmember)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.network_security_address_group_iam_member.new` injects a new `google_network_security_address_group_iam_member` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.network_security_address_group_iam_member.new('some_id')
+
+You can get the reference to the `id` field of the created `google.network_security_address_group_iam_member` using the reference:
+
+    $._ref.google_network_security_address_group_iam_member.some_id.get('id')
+
+This is the same as directly entering `"${ google_network_security_address_group_iam_member.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `member` (`string`): Set the `member` field on the resulting resource block.
+  - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.network_security_address_group_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_member`
+Terraform resource.
+
+Unlike [google.network_security_address_group_iam_member.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `member` (`string`): Set the `member` field on the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group_iam_member` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMember
+
+```ts
+withMember()
+```
+
+`google.string.withMember` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the member field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `member` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.network_security_address_group_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/network_security_address_group_iam_policy.md b/docs/4.x/network_security_address_group_iam_policy.md
new file mode 100644
index 00000000..19468eef
--- /dev/null
+++ b/docs/4.x/network_security_address_group_iam_policy.md
@@ -0,0 +1,149 @@
+---
+permalink: /network_security_address_group_iam_policy/
+---
+
+# network_security_address_group_iam_policy
+
+`network_security_address_group_iam_policy` represents the `google_network_security_address_group_iam_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withPolicyData()`](#fn-withpolicydata)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.network_security_address_group_iam_policy.new` injects a new `google_network_security_address_group_iam_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.network_security_address_group_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.network_security_address_group_iam_policy` using the reference:
+
+    $._ref.google_network_security_address_group_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_network_security_address_group_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.network_security_address_group_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group_iam_policy`
+Terraform resource.
+
+Unlike [google.network_security_address_group_iam_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting object.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group_iam_policy` resource into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withPolicyData
+
+```ts
+withPolicyData()
+```
+
+`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the policy_data field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `policy_data` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/network_services_edge_cache_keyset.md b/docs/4.x/network_services_edge_cache_keyset.md
index f85ac479..7e08feed 100644
--- a/docs/4.x/network_services_edge_cache_keyset.md
+++ b/docs/4.x/network_services_edge_cache_keyset.md
@@ -62,7 +62,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
@@ -103,7 +106,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
diff --git a/docs/4.x/network_services_edge_cache_origin.md b/docs/4.x/network_services_edge_cache_origin.md
index cf305366..99dc7e00 100644
--- a/docs/4.x/network_services_edge_cache_origin.md
+++ b/docs/4.x/network_services_edge_cache_origin.md
@@ -87,7 +87,10 @@ After maxAttempts is reached, the configured failoverOrigin will be used to fulf
 
 The value of timeout.maxAttemptsTimeout dictates the timeout across all origins.
 A reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.
 
 Once maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,
@@ -168,7 +171,10 @@ After maxAttempts is reached, the configured failoverOrigin will be used to fulf
 
 The value of timeout.maxAttemptsTimeout dictates the timeout across all origins.
 A reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.
 
 Once maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,
diff --git a/docs/4.x/network_services_edge_cache_service.md b/docs/4.x/network_services_edge_cache_service.md
index af275ef8..ae9bcdbd 100644
--- a/docs/4.x/network_services_edge_cache_service.md
+++ b/docs/4.x/network_services_edge_cache_service.md
@@ -116,7 +116,10 @@ Some legacy HTTP clients may have issues with HTTP/2 connections due to broken H
   - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.
 
 Note that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
@@ -165,7 +168,10 @@ Some legacy HTTP clients may have issues with HTTP/2 connections due to broken H
   - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.
 
 Note that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
diff --git a/docs/4.x/network_services_gateway.md b/docs/4.x/network_services_gateway.md
index e0a076cb..3160c459 100644
--- a/docs/4.x/network_services_gateway.md
+++ b/docs/4.x/network_services_gateway.md
@@ -75,7 +75,10 @@ If there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for
   - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.
 For example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.
 This policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Short name of the Gateway resource to be created.
@@ -131,7 +134,10 @@ If there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for
   - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.
 For example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.
 This policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Short name of the Gateway resource to be created.
diff --git a/docs/4.x/notebooks_instance.md b/docs/4.x/notebooks_instance.md
index 86d1d4a4..22e11e49 100644
--- a/docs/4.x/notebooks_instance.md
+++ b/docs/4.x/notebooks_instance.md
@@ -120,7 +120,11 @@ your VM instance's service account can use the instance. When `null`, the `i
   - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.
 Format: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.
   - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): A reference to the zone where the machine resides.
   - `machine_type` (`string`): A reference to a machine type which defines VM kind.
   - `metadata` (`obj`): Custom metadata to apply to this instance.
@@ -205,7 +209,11 @@ your VM instance's service account can use the instance. When `null`, the `i
   - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.
 Format: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.
   - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): A reference to the zone where the machine resides.
   - `machine_type` (`string`): A reference to a machine type which defines VM kind.
   - `metadata` (`obj`): Custom metadata to apply to this instance.
diff --git a/docs/4.x/notebooks_runtime.md b/docs/4.x/notebooks_runtime.md
index 6b90b1f7..1fb490c2 100644
--- a/docs/4.x/notebooks_runtime.md
+++ b/docs/4.x/notebooks_runtime.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withAccessConfig()`](#fn-withaccessconfig)
 * [`fn withAccessConfigMixin()`](#fn-withaccessconfigmixin)
+* [`fn withLabels()`](#fn-withlabels)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
@@ -80,6 +81,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `labels` (`obj`): The labels to associate with this runtime. Label **keys** must
+contain 1 to 63 characters, and must conform to [RFC 1035]
+(https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be
+empty, but, if present, must contain 1 to 63 characters, and must
+conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No
+more than 32 labels can be associated with a cluster.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): A reference to the zone where the machine resides.
   - `name` (`string`): The name specified for the Notebook runtime.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -110,6 +121,16 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `labels` (`obj`): The labels to associate with this runtime. Label **keys** must
+contain 1 to 63 characters, and must conform to [RFC 1035]
+(https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be
+empty, but, if present, must contain 1 to 63 characters, and must
+conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No
+more than 32 labels can be associated with a cluster.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): A reference to the zone where the machine resides.
   - `name` (`string`): The name specified for the Notebook runtime.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -159,6 +180,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `access_config` field.
 
 
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
 ### fn withLocation
 
 ```ts
diff --git a/docs/4.x/org_policy_custom_constraint.md b/docs/4.x/org_policy_custom_constraint.md
new file mode 100644
index 00000000..05aad3de
--- /dev/null
+++ b/docs/4.x/org_policy_custom_constraint.md
@@ -0,0 +1,292 @@
+---
+permalink: /org_policy_custom_constraint/
+---
+
+# org_policy_custom_constraint
+
+`org_policy_custom_constraint` represents the `google_org_policy_custom_constraint` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withActionType()`](#fn-withactiontype)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withMethodTypes()`](#fn-withmethodtypes)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withResourceTypes()`](#fn-withresourcetypes)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.org_policy_custom_constraint.new` injects a new `google_org_policy_custom_constraint` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.org_policy_custom_constraint.new('some_id')
+
+You can get the reference to the `id` field of the created `google.org_policy_custom_constraint` using the reference:
+
+    $._ref.google_org_policy_custom_constraint.some_id.get('id')
+
+This is the same as directly entering `"${ google_org_policy_custom_constraint.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]
+  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).
+  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).
+  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.org_policy_custom_constraint.newAttrs` constructs a new object with attributes and blocks configured for the `org_policy_custom_constraint`
+Terraform resource.
+
+Unlike [google.org_policy_custom_constraint.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]
+  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).
+  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).
+  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_custom_constraint` resource into the root Terraform configuration.
+
+
+### fn withActionType
+
+```ts
+withActionType()
+```
+
+`google.string.withActionType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the action_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `action_type` field.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.string.withCondition` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the condition field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `condition` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withMethodTypes
+
+```ts
+withMethodTypes()
+```
+
+`google.list.withMethodTypes` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the method_types field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `method_types` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withResourceTypes
+
+```ts
+withResourceTypes()
+```
+
+`google.list.withResourceTypes` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the resource_types field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `resource_types` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.org_policy_custom_constraint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/org_policy_policy.md b/docs/4.x/org_policy_policy.md
index d664816b..44419070 100644
--- a/docs/4.x/org_policy_policy.md
+++ b/docs/4.x/org_policy_policy.md
@@ -15,12 +15,22 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDryRunSpec()`](#fn-withdryrunspec)
+* [`fn withDryRunSpecMixin()`](#fn-withdryrunspecmixin)
 * [`fn withName()`](#fn-withname)
 * [`fn withParent()`](#fn-withparent)
 * [`fn withSpec()`](#fn-withspec)
 * [`fn withSpecMixin()`](#fn-withspecmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj dry_run_spec`](#obj-dry_run_spec)
+  * [`fn new()`](#fn-dry_run_specnew)
+  * [`obj dry_run_spec.rules`](#obj-dry_run_specrules)
+    * [`fn new()`](#fn-dry_run_specrulesnew)
+    * [`obj dry_run_spec.rules.condition`](#obj-dry_run_specrulescondition)
+      * [`fn new()`](#fn-dry_run_specrulesconditionnew)
+    * [`obj dry_run_spec.rules.values`](#obj-dry_run_specrulesvalues)
+      * [`fn new()`](#fn-dry_run_specrulesvaluesnew)
 * [`obj spec`](#obj-spec)
   * [`fn new()`](#fn-specnew)
   * [`obj spec.rules`](#obj-specrules)
@@ -63,6 +73,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `name` (`string`): Immutable. The resource name of the Policy. Must be one of the following forms, where constraint_name is the name of the constraint which this Policy configures: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}` For example, "projects/123/policies/compute.disableSerialPortAccess". Note: `projects/{project_id}/policies/{constraint_name}` is also an acceptable name for API requests, but responses will return the name using the equivalent project number.
   - `parent` (`string`): The parent of the resource.
+  - `dry_run_spec` (`list[obj]`): Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it's enforced. When `null`, the `dry_run_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.new](#fn-dry_run_specnew) constructor.
   - `spec` (`list[obj]`): Basic information about the Organization Policy. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.new](#fn-specnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -90,6 +101,7 @@ injecting into a complete block.
 **Args**:
   - `name` (`string`): Immutable. The resource name of the Policy. Must be one of the following forms, where constraint_name is the name of the constraint which this Policy configures: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}` For example, "projects/123/policies/compute.disableSerialPortAccess". Note: `projects/{project_id}/policies/{constraint_name}` is also an acceptable name for API requests, but responses will return the name using the equivalent project number.
   - `parent` (`string`): The parent of the resource.
+  - `dry_run_spec` (`list[obj]`): Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it's enforced. When `null`, the `dry_run_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.new](#fn-dry_run_specnew) constructor.
   - `spec` (`list[obj]`): Basic information about the Organization Policy. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.new](#fn-specnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -97,6 +109,43 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_policy` resource into the root Terraform configuration.
 
 
+### fn withDryRunSpec
+
+```ts
+withDryRunSpec()
+```
+
+`google.list[obj].withDryRunSpec` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dry_run_spec field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDryRunSpecMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dry_run_spec` field.
+
+
+### fn withDryRunSpecMixin
+
+```ts
+withDryRunSpecMixin()
+```
+
+`google.list[obj].withDryRunSpecMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dry_run_spec field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDryRunSpec](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dry_run_spec` field.
+
+
 ### fn withName
 
 ```ts
@@ -202,6 +251,108 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj dry_run_spec
+
+
+
+### fn dry_run_spec.new
+
+```ts
+new()
+```
+
+
+`google.org_policy_policy.dry_run_spec.new` constructs a new object with attributes and blocks configured for the `dry_run_spec`
+Terraform sub block.
+
+
+
+**Args**:
+  - `inherit_from_parent` (`bool`): Determines the inheritance behavior for this policy. If `inherit_from_parent` is true, policy rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the new root for evaluation. This field can be set only for policies which configure list constraints. When `null`, the `inherit_from_parent` field will be omitted from the resulting object.
+  - `reset` (`bool`): Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false. When `null`, the `reset` field will be omitted from the resulting object.
+  - `rules` (`list[obj]`): In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.rules.new](#fn-dry_run_specrulesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `dry_run_spec` sub block.
+
+
+## obj dry_run_spec.rules
+
+
+
+### fn dry_run_spec.rules.new
+
+```ts
+new()
+```
+
+
+`google.org_policy_policy.dry_run_spec.rules.new` constructs a new object with attributes and blocks configured for the `rules`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allow_all` (`string`): Setting this to `"TRUE"` means that all values are allowed. This field can be set only in policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.
+  - `deny_all` (`string`): Setting this to `"TRUE"` means that all values are denied. This field can be set only in policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.
+  - `enforce` (`string`): If `"TRUE"`, then the policy is enforced. If `"FALSE"`, then any configuration is acceptable. This field can be set only in policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.
+  - `condition` (`list[obj]`): A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')". When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.rules.condition.new](#fn-dry_run_specdry_run_specconditionnew) constructor.
+  - `values` (`list[obj]`): List of values to be used for this policy rule. This field can be set only in policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.dry_run_spec.rules.values.new](#fn-dry_run_specdry_run_specvaluesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `rules` sub block.
+
+
+## obj dry_run_spec.rules.condition
+
+
+
+### fn dry_run_spec.rules.condition.new
+
+```ts
+new()
+```
+
+
+`google.org_policy_policy.dry_run_spec.rules.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax. When `null`, the `expression` field will be omitted from the resulting object.
+  - `location` (`string`): Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
+
+
+## obj dry_run_spec.rules.values
+
+
+
+### fn dry_run_spec.rules.values.new
+
+```ts
+new()
+```
+
+
+`google.org_policy_policy.dry_run_spec.rules.values.new` constructs a new object with attributes and blocks configured for the `values`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allowed_values` (`list`): List of values allowed at this resource. When `null`, the `allowed_values` field will be omitted from the resulting object.
+  - `denied_values` (`list`): List of values denied at this resource. When `null`, the `denied_values` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `values` sub block.
+
+
 ## obj spec
 
 
@@ -244,9 +395,9 @@ Terraform sub block.
 
 
 **Args**:
-  - `allow_all` (`string`): Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.
-  - `deny_all` (`string`): Setting this to true means that all values are denied. This field can be set only in Policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.
-  - `enforce` (`string`): If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.
+  - `allow_all` (`string`): Setting this to `"TRUE"` means that all values are allowed. This field can be set only in Policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.
+  - `deny_all` (`string`): Setting this to `"TRUE"` means that all values are denied. This field can be set only in Policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.
+  - `enforce` (`string`): If `"TRUE"`, then the `Policy` is enforced. If `"FALSE"`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.
   - `condition` (`list[obj]`): A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')". When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.rules.condition.new](#fn-specspecconditionnew) constructor.
   - `values` (`list[obj]`): List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_policy.spec.rules.values.new](#fn-specspecvaluesnew) constructor.
 
diff --git a/docs/4.x/os_config_patch_deployment.md b/docs/4.x/os_config_patch_deployment.md
index 4342899b..b20ff778 100644
--- a/docs/4.x/os_config_patch_deployment.md
+++ b/docs/4.x/os_config_patch_deployment.md
@@ -1034,6 +1034,7 @@ Terraform sub block.
 
 **Args**:
   - `day_of_week` (`string`): A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]
+  - `day_offset` (`number`): Represents the number of days before or after the given week day of month that the patch deployment is scheduled for. When `null`, the `day_offset` field will be omitted from the resulting object.
   - `week_ordinal` (`number`): Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.
 
 **Returns**:
diff --git a/docs/4.x/privateca_ca_pool.md b/docs/4.x/privateca_ca_pool.md
index ce3c1f88..24a41fa0 100644
--- a/docs/4.x/privateca_ca_pool.md
+++ b/docs/4.x/privateca_ca_pool.md
@@ -97,7 +97,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by
 running 'gcloud privateca locations list'.
   - `name` (`string`): The name for this CaPool.
@@ -132,7 +136,11 @@ injecting into a complete block.
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by
 running 'gcloud privateca locations list'.
   - `name` (`string`): The name for this CaPool.
diff --git a/docs/4.x/privateca_certificate.md b/docs/4.x/privateca_certificate.md
index 6a4f447d..3cff320d 100644
--- a/docs/4.x/privateca_certificate.md
+++ b/docs/4.x/privateca_certificate.md
@@ -99,7 +99,11 @@ in the format 'projects/*/locations/*/certificateTemplates/*'. If this i
 the caller must have the necessary permission to use this template. If this is
 omitted, no template will be used. This template must be in the same location
 as the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
@@ -143,7 +147,11 @@ in the format 'projects/*/locations/*/certificateTemplates/*'. If this i
 the caller must have the necessary permission to use this template. If this is
 omitted, no template will be used. This template must be in the same location
 as the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
diff --git a/docs/4.x/privateca_certificate_authority.md b/docs/4.x/privateca_certificate_authority.md
index 56d21ef1..17054d48 100644
--- a/docs/4.x/privateca_certificate_authority.md
+++ b/docs/4.x/privateca_certificate_authority.md
@@ -116,7 +116,11 @@ Use with care. Defaults to 'false'. When `null`, the `ignore_active_cert
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
@@ -177,7 +181,11 @@ Use with care. Defaults to 'false'. When `null`, the `ignore_active_cert
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
diff --git a/docs/4.x/privateca_certificate_template.md b/docs/4.x/privateca_certificate_template.md
index 40d84b1f..ef30657f 100644
--- a/docs/4.x/privateca_certificate_template.md
+++ b/docs/4.x/privateca_certificate_template.md
@@ -87,7 +87,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels with user-defined metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -119,7 +122,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels with user-defined metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/project.md b/docs/4.x/project.md
index 5133a7b3..62aa0258 100644
--- a/docs/4.x/project.md
+++ b/docs/4.x/project.md
@@ -60,7 +60,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.
   - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.
   - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the project.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The display name of the project.
   - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.
   - `project_id` (`string`): The project ID. Changing this forces a new project to be created.
@@ -92,7 +95,10 @@ injecting into a complete block.
   - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.
   - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.
   - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the project.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The display name of the project.
   - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.
   - `project_id` (`string`): The project ID. Changing this forces a new project to be created.
diff --git a/docs/4.x/provider.md b/docs/4.x/provider.md
index 0b9c0649..5d3a03b3 100644
--- a/docs/4.x/provider.md
+++ b/docs/4.x/provider.md
@@ -57,6 +57,7 @@ the `src` and/or `version` parameters are set.
   - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting provider block. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.
   - `billing_project` (`string`): Set the `billing_project` field on the resulting provider block. When `null`, the `billing_project` field will be omitted from the resulting object.
   - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting provider block. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.
+  - `blockchain_node_engine_custom_endpoint` (`string`): Set the `blockchain_node_engine_custom_endpoint` field on the resulting provider block. When `null`, the `blockchain_node_engine_custom_endpoint` field will be omitted from the resulting object.
   - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting provider block. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.
@@ -65,7 +66,6 @@ the `src` and/or `version` parameters are set.
   - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.
-  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.
@@ -73,6 +73,7 @@ the `src` and/or `version` parameters are set.
   - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.
   - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.
   - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting provider block. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.
+  - `clouddomains_custom_endpoint` (`string`): Set the `clouddomains_custom_endpoint` field on the resulting provider block. When `null`, the `clouddomains_custom_endpoint` field will be omitted from the resulting object.
   - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.
   - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting provider block. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.
   - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting provider block. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.
@@ -94,23 +95,26 @@ the `src` and/or `version` parameters are set.
   - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting provider block. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting provider block. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.
+  - `default_labels` (`obj`): Set the `default_labels` field on the resulting provider block. When `null`, the `default_labels` field will be omitted from the resulting object.
   - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting provider block. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.
+  - `discovery_engine_custom_endpoint` (`string`): Set the `discovery_engine_custom_endpoint` field on the resulting provider block. When `null`, the `discovery_engine_custom_endpoint` field will be omitted from the resulting object.
   - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting provider block. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.
+  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting provider block. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.
   - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting provider block. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.
   - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting provider block. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.
   - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting provider block. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.
   - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting provider block. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.
   - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting provider block. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.
   - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting provider block. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.
-  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting provider block. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.
   - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting provider block. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.
   - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting provider block. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.
+  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting provider block. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.
   - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting provider block. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.
   - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting provider block. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.
   - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting provider block. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.
@@ -121,12 +125,15 @@ the `src` and/or `version` parameters are set.
   - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting provider block. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.
   - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting provider block. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.
   - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting provider block. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.
+  - `integration_connectors_custom_endpoint` (`string`): Set the `integration_connectors_custom_endpoint` field on the resulting provider block. When `null`, the `integration_connectors_custom_endpoint` field will be omitted from the resulting object.
   - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting provider block. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.
   - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting provider block. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.
   - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting provider block. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.
   - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting provider block. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.
+  - `migration_center_custom_endpoint` (`string`): Set the `migration_center_custom_endpoint` field on the resulting provider block. When `null`, the `migration_center_custom_endpoint` field will be omitted from the resulting object.
   - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting provider block. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.
   - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting provider block. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.
+  - `netapp_custom_endpoint` (`string`): Set the `netapp_custom_endpoint` field on the resulting provider block. When `null`, the `netapp_custom_endpoint` field will be omitted from the resulting object.
   - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting provider block. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.
   - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting provider block. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.
   - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting provider block. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.
@@ -149,7 +156,9 @@ the `src` and/or `version` parameters are set.
   - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.
   - `scopes` (`list`): Set the `scopes` field on the resulting provider block. When `null`, the `scopes` field will be omitted from the resulting object.
   - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.
+  - `secure_source_manager_custom_endpoint` (`string`): Set the `secure_source_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secure_source_manager_custom_endpoint` field will be omitted from the resulting object.
   - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting provider block. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.
+  - `securityposture_custom_endpoint` (`string`): Set the `securityposture_custom_endpoint` field on the resulting provider block. When `null`, the `securityposture_custom_endpoint` field will be omitted from the resulting object.
   - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting provider block. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.
   - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting provider block. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.
   - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting provider block. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.
@@ -162,9 +171,12 @@ the `src` and/or `version` parameters are set.
   - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting provider block. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.
   - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting provider block. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.
   - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting provider block. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.
+  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting provider block. When `null`, the `universe_domain` field will be omitted from the resulting object.
   - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting provider block. When `null`, the `user_project_override` field will be omitted from the resulting object.
   - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting provider block. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.
+  - `vmwareengine_custom_endpoint` (`string`): Set the `vmwareengine_custom_endpoint` field on the resulting provider block. When `null`, the `vmwareengine_custom_endpoint` field will be omitted from the resulting object.
   - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting provider block. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.
+  - `workbench_custom_endpoint` (`string`): Set the `workbench_custom_endpoint` field on the resulting provider block. When `null`, the `workbench_custom_endpoint` field will be omitted from the resulting object.
   - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting provider block. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.
   - `zone` (`string`): Set the `zone` field on the resulting provider block. When `null`, the `zone` field will be omitted from the resulting object.
   - `batching` (`list[obj]`): Set the `batching` field on the resulting provider block. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.
@@ -221,6 +233,7 @@ injecting into a complete block.
   - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting object. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.
   - `billing_project` (`string`): Set the `billing_project` field on the resulting object. When `null`, the `billing_project` field will be omitted from the resulting object.
   - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting object. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.
+  - `blockchain_node_engine_custom_endpoint` (`string`): Set the `blockchain_node_engine_custom_endpoint` field on the resulting object. When `null`, the `blockchain_node_engine_custom_endpoint` field will be omitted from the resulting object.
   - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting object. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting object. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting object. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.
@@ -229,7 +242,6 @@ injecting into a complete block.
   - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting object. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting object. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting object. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.
-  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting object. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting object. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.
@@ -237,6 +249,7 @@ injecting into a complete block.
   - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting object. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.
   - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting object. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.
   - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting object. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.
+  - `clouddomains_custom_endpoint` (`string`): Set the `clouddomains_custom_endpoint` field on the resulting object. When `null`, the `clouddomains_custom_endpoint` field will be omitted from the resulting object.
   - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting object. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.
   - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting object. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.
   - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting object. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.
@@ -258,23 +271,26 @@ injecting into a complete block.
   - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting object. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting object. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting object. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.
+  - `default_labels` (`obj`): Set the `default_labels` field on the resulting object. When `null`, the `default_labels` field will be omitted from the resulting object.
   - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting object. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.
+  - `discovery_engine_custom_endpoint` (`string`): Set the `discovery_engine_custom_endpoint` field on the resulting object. When `null`, the `discovery_engine_custom_endpoint` field will be omitted from the resulting object.
   - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting object. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting object. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting object. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.
+  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting object. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.
   - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting object. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.
   - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting object. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.
   - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting object. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.
   - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting object. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.
   - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting object. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.
   - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting object. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.
-  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting object. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.
   - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting object. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting object. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting object. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.
   - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting object. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.
+  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting object. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.
   - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting object. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.
   - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting object. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.
   - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting object. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.
@@ -285,12 +301,15 @@ injecting into a complete block.
   - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting object. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.
   - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting object. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.
   - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting object. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.
+  - `integration_connectors_custom_endpoint` (`string`): Set the `integration_connectors_custom_endpoint` field on the resulting object. When `null`, the `integration_connectors_custom_endpoint` field will be omitted from the resulting object.
   - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting object. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.
   - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting object. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.
   - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting object. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.
   - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting object. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.
+  - `migration_center_custom_endpoint` (`string`): Set the `migration_center_custom_endpoint` field on the resulting object. When `null`, the `migration_center_custom_endpoint` field will be omitted from the resulting object.
   - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting object. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.
   - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting object. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.
+  - `netapp_custom_endpoint` (`string`): Set the `netapp_custom_endpoint` field on the resulting object. When `null`, the `netapp_custom_endpoint` field will be omitted from the resulting object.
   - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting object. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.
   - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting object. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.
   - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting object. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.
@@ -313,7 +332,9 @@ injecting into a complete block.
   - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.
   - `scopes` (`list`): Set the `scopes` field on the resulting object. When `null`, the `scopes` field will be omitted from the resulting object.
   - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting object. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.
+  - `secure_source_manager_custom_endpoint` (`string`): Set the `secure_source_manager_custom_endpoint` field on the resulting object. When `null`, the `secure_source_manager_custom_endpoint` field will be omitted from the resulting object.
   - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting object. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.
+  - `securityposture_custom_endpoint` (`string`): Set the `securityposture_custom_endpoint` field on the resulting object. When `null`, the `securityposture_custom_endpoint` field will be omitted from the resulting object.
   - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting object. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.
   - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting object. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.
   - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting object. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.
@@ -326,9 +347,12 @@ injecting into a complete block.
   - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting object. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.
   - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting object. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.
   - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting object. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.
+  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting object. When `null`, the `universe_domain` field will be omitted from the resulting object.
   - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting object. When `null`, the `user_project_override` field will be omitted from the resulting object.
   - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting object. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.
+  - `vmwareengine_custom_endpoint` (`string`): Set the `vmwareengine_custom_endpoint` field on the resulting object. When `null`, the `vmwareengine_custom_endpoint` field will be omitted from the resulting object.
   - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting object. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.
+  - `workbench_custom_endpoint` (`string`): Set the `workbench_custom_endpoint` field on the resulting object. When `null`, the `workbench_custom_endpoint` field will be omitted from the resulting object.
   - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting object. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.
   - `zone` (`string`): Set the `zone` field on the resulting object. When `null`, the `zone` field will be omitted from the resulting object.
   - `batching` (`list[obj]`): Set the `batching` field on the resulting object. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.
diff --git a/docs/4.x/pubsub_schema.md b/docs/4.x/pubsub_schema.md
index 0b3c07c5..55170130 100644
--- a/docs/4.x/pubsub_schema.md
+++ b/docs/4.x/pubsub_schema.md
@@ -55,7 +55,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `definition` (`string`): The definition of the schema.
 This should contain a string representing the full definition of the schema
-that is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.
+that is a valid schema definition of the type specified in type. Changes
+to the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).
+A schema can only have up to 20 revisions, so updates that fail with an
+error indicating that the limit has been reached require manually
+[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.
   - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.
@@ -85,7 +89,11 @@ injecting into a complete block.
 **Args**:
   - `definition` (`string`): The definition of the schema.
 This should contain a string representing the full definition of the schema
-that is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.
+that is a valid schema definition of the type specified in type. Changes
+to the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).
+A schema can only have up to 20 revisions, so updates that fail with an
+error indicating that the limit has been reached require manually
+[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.
   - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.
diff --git a/docs/4.x/pubsub_schema_iam_binding.md b/docs/4.x/pubsub_schema_iam_binding.md
new file mode 100644
index 00000000..c2d3c85e
--- /dev/null
+++ b/docs/4.x/pubsub_schema_iam_binding.md
@@ -0,0 +1,217 @@
+---
+permalink: /pubsub_schema_iam_binding/
+---
+
+# pubsub_schema_iam_binding
+
+`pubsub_schema_iam_binding` represents the `google_pubsub_schema_iam_binding` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withMembers()`](#fn-withmembers)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`fn withSchema()`](#fn-withschema)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.pubsub_schema_iam_binding.new` injects a new `google_pubsub_schema_iam_binding` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.pubsub_schema_iam_binding.new('some_id')
+
+You can get the reference to the `id` field of the created `google.pubsub_schema_iam_binding` using the reference:
+
+    $._ref.google_pubsub_schema_iam_binding.some_id.get('id')
+
+This is the same as directly entering `"${ google_pubsub_schema_iam_binding.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `members` (`list`): Set the `members` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `schema` (`string`): Set the `schema` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.pubsub_schema_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_binding`
+Terraform resource.
+
+Unlike [google.pubsub_schema_iam_binding.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `members` (`list`): Set the `members` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_binding` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withMembers
+
+```ts
+withMembers()
+```
+
+`google.list.withMembers` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the members field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `members` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+### fn withSchema
+
+```ts
+withSchema()
+```
+
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the schema field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `schema` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.pubsub_schema_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/pubsub_schema_iam_member.md b/docs/4.x/pubsub_schema_iam_member.md
new file mode 100644
index 00000000..181b6a73
--- /dev/null
+++ b/docs/4.x/pubsub_schema_iam_member.md
@@ -0,0 +1,217 @@
+---
+permalink: /pubsub_schema_iam_member/
+---
+
+# pubsub_schema_iam_member
+
+`pubsub_schema_iam_member` represents the `google_pubsub_schema_iam_member` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withMember()`](#fn-withmember)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`fn withSchema()`](#fn-withschema)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.pubsub_schema_iam_member.new` injects a new `google_pubsub_schema_iam_member` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.pubsub_schema_iam_member.new('some_id')
+
+You can get the reference to the `id` field of the created `google.pubsub_schema_iam_member` using the reference:
+
+    $._ref.google_pubsub_schema_iam_member.some_id.get('id')
+
+This is the same as directly entering `"${ google_pubsub_schema_iam_member.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `member` (`string`): Set the `member` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `schema` (`string`): Set the `schema` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.pubsub_schema_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_member`
+Terraform resource.
+
+Unlike [google.pubsub_schema_iam_member.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `member` (`string`): Set the `member` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_member` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withMember
+
+```ts
+withMember()
+```
+
+`google.string.withMember` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the member field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `member` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+### fn withSchema
+
+```ts
+withSchema()
+```
+
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the schema field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `schema` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.pubsub_schema_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/pubsub_schema_iam_policy.md b/docs/4.x/pubsub_schema_iam_policy.md
new file mode 100644
index 00000000..419f01f4
--- /dev/null
+++ b/docs/4.x/pubsub_schema_iam_policy.md
@@ -0,0 +1,130 @@
+---
+permalink: /pubsub_schema_iam_policy/
+---
+
+# pubsub_schema_iam_policy
+
+`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withPolicyData()`](#fn-withpolicydata)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withSchema()`](#fn-withschema)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.pubsub_schema_iam_policy.new` injects a new `google_pubsub_schema_iam_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.pubsub_schema_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.pubsub_schema_iam_policy` using the reference:
+
+    $._ref.google_pubsub_schema_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_pubsub_schema_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting resource block.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`
+Terraform resource.
+
+Unlike [google.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_policy` resource into the root Terraform configuration.
+
+
+### fn withPolicyData
+
+```ts
+withPolicyData()
+```
+
+`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the policy_data field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `policy_data` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withSchema
+
+```ts
+withSchema()
+```
+
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the schema field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `schema` field.
diff --git a/docs/4.x/pubsub_subscription.md b/docs/4.x/pubsub_subscription.md
index d5bd21c7..5ff5c913 100644
--- a/docs/4.x/pubsub_subscription.md
+++ b/docs/4.x/pubsub_subscription.md
@@ -123,7 +123,11 @@ may be delivered in any order. When `null`, the `enable_message_ordering` field
 Pub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages
 by their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,
 you can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's
 backlog, from the moment a message is published. If
 retain_acked_messages is true, then this also configures the retention
@@ -139,7 +143,9 @@ by 's'. Example: '"600.5s"'. When `null`, the `message_r
 messages are not expunged from the subscription's backlog, even if
 they are acknowledged, until they fall out of the
 messageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.
-  - `topic` (`string`): A reference to a Topic resource.
+  - `topic` (`string`): A reference to a Topic resource, of the form projects/{project}/topics/{{name}}
+(as in the id property of a google_pubsub_topic), or just a topic name if
+the topic is in the same project as the subscription.
   - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.
 Either pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.
 If all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.
@@ -226,7 +232,11 @@ may be delivered in any order. When `null`, the `enable_message_ordering` field
 Pub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages
 by their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,
 you can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's
 backlog, from the moment a message is published. If
 retain_acked_messages is true, then this also configures the retention
@@ -242,7 +252,9 @@ by 's'. Example: '"600.5s"'. When `null`, the `message_r
 messages are not expunged from the subscription's backlog, even if
 they are acknowledged, until they fall out of the
 messageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.
-  - `topic` (`string`): A reference to a Topic resource.
+  - `topic` (`string`): A reference to a Topic resource, of the form projects/{project}/topics/{{name}}
+(as in the id property of a google_pubsub_topic), or just a topic name if
+the topic is in the same project as the subscription.
   - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.
 Either pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.
 If all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.
@@ -712,10 +724,14 @@ Terraform sub block.
 
 
 **Args**:
-  - `drop_unknown_fields` (`bool`): When true and useTopicSchema is true, any fields that are a part of the topic schema that are not part of the BigQuery table schema are dropped when writing to BigQuery.
-Otherwise, the schemas must be kept in sync and any messages with extra fields are not written and remain in the subscription's backlog. When `null`, the `drop_unknown_fields` field will be omitted from the resulting object.
+  - `drop_unknown_fields` (`bool`): When true and use_topic_schema or use_table_schema is true, any fields that are a part of the topic schema or message schema that
+are not part of the BigQuery table schema are dropped when writing to BigQuery. Otherwise, the schemas must be kept in sync
+and any messages with extra fields are not written and remain in the subscription's backlog. When `null`, the `drop_unknown_fields` field will be omitted from the resulting object.
   - `table` (`string`): The name of the table to which to write data, of the form {projectId}:{datasetId}.{tableId}
-  - `use_topic_schema` (`bool`): When true, use the topic's schema as the columns to write to in BigQuery, if it exists. When `null`, the `use_topic_schema` field will be omitted from the resulting object.
+  - `use_table_schema` (`bool`): When true, use the BigQuery table's schema as the columns to write to in BigQuery. Messages
+must be published in JSON format. Only one of use_topic_schema and use_table_schema can be set. When `null`, the `use_table_schema` field will be omitted from the resulting object.
+  - `use_topic_schema` (`bool`): When true, use the topic's schema as the columns to write to in BigQuery, if it exists.
+Only one of use_topic_schema and use_table_schema can be set. When `null`, the `use_topic_schema` field will be omitted from the resulting object.
   - `write_metadata` (`bool`): When true, write the subscription name, messageId, publishTime, attributes, and orderingKey to additional columns in the table.
 The subscription name, messageId, and publishTime fields are put in their own columns while all other message properties (other than data) are written to a JSON object in the attributes column. When `null`, the `write_metadata` field will be omitted from the resulting object.
 
diff --git a/docs/4.x/pubsub_topic.md b/docs/4.x/pubsub_topic.md
index c780b8f8..ec1fedc2 100644
--- a/docs/4.x/pubsub_topic.md
+++ b/docs/4.x/pubsub_topic.md
@@ -67,14 +67,19 @@ to messages published on this topic. Your project's PubSub service account
 ('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have
 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.
 The expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published
 to the topic. If this field is set, messages published to the topic in
 the last messageRetentionDuration are always available to subscribers.
 For instance, it allows any attached subscription to seek to a timestamp
 that is up to messageRetentionDuration in the past. If this field is not
 set, message retention is controlled by settings on individual subscriptions.
-Cannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.
+The rotation period has the format of a decimal number, followed by the
+letter 's' (seconds). Cannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.
   - `name` (`string`): Name of the topic.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where
@@ -110,14 +115,19 @@ to messages published on this topic. Your project's PubSub service account
 ('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have
 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.
 The expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published
 to the topic. If this field is set, messages published to the topic in
 the last messageRetentionDuration are always available to subscribers.
 For instance, it allows any attached subscription to seek to a timestamp
 that is up to messageRetentionDuration in the past. If this field is not
 set, message retention is controlled by settings on individual subscriptions.
-Cannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.
+The rotation period has the format of a decimal number, followed by the
+letter 's' (seconds). Cannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.
   - `name` (`string`): Name of the topic.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where
diff --git a/docs/4.x/recaptcha_enterprise_key.md b/docs/4.x/recaptcha_enterprise_key.md
index 37517d3a..b17568c4 100644
--- a/docs/4.x/recaptcha_enterprise_key.md
+++ b/docs/4.x/recaptcha_enterprise_key.md
@@ -26,6 +26,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTestingOptionsMixin()`](#fn-withtestingoptionsmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withWafSettings()`](#fn-withwafsettings)
+* [`fn withWafSettingsMixin()`](#fn-withwafsettingsmixin)
 * [`fn withWebSettings()`](#fn-withwebsettings)
 * [`fn withWebSettingsMixin()`](#fn-withwebsettingsmixin)
 * [`obj android_settings`](#obj-android_settings)
@@ -36,6 +38,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-testing_optionsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
+* [`obj waf_settings`](#obj-waf_settings)
+  * [`fn new()`](#fn-waf_settingsnew)
 * [`obj web_settings`](#obj-web_settings)
   * [`fn new()`](#fn-web_settingsnew)
 
@@ -69,12 +73,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.
-  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.
   - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.
   - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.
+  - `waf_settings` (`list[obj]`): Settings specific to keys that can be used for WAF (Web Application Firewall). When `null`, the `waf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.waf_settings.new](#fn-waf_settingsnew) constructor.
   - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.
 
 **Returns**:
@@ -100,12 +108,16 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.
-  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.
   - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.
   - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.
+  - `waf_settings` (`list[obj]`): Settings specific to keys that can be used for WAF (Web Application Firewall). When `null`, the `waf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.waf_settings.new](#fn-waf_settingsnew) constructor.
   - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.
 
 **Returns**:
@@ -307,6 +319,43 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withWafSettings
+
+```ts
+withWafSettings()
+```
+
+`google.list[obj].withWafSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the waf_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withWafSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `waf_settings` field.
+
+
+### fn withWafSettingsMixin
+
+```ts
+withWafSettingsMixin()
+```
+
+`google.list[obj].withWafSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the waf_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withWafSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `waf_settings` field.
+
+
 ### fn withWebSettings
 
 ```ts
@@ -441,6 +490,30 @@ Terraform sub block.
   - An attribute object that represents the `timeouts` sub block.
 
 
+## obj waf_settings
+
+
+
+### fn waf_settings.new
+
+```ts
+new()
+```
+
+
+`google.recaptcha_enterprise_key.waf_settings.new` constructs a new object with attributes and blocks configured for the `waf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `waf_feature` (`string`): Supported WAF features. For more information, see https://cloud.google.com/recaptcha-enterprise/docs/usecase#comparison_of_features. Possible values: CHALLENGE_PAGE, SESSION_TOKEN, ACTION_TOKEN, EXPRESS
+  - `waf_service` (`string`): The WAF service that uses this key. Possible values: CA, FASTLY
+
+**Returns**:
+  - An attribute object that represents the `waf_settings` sub block.
+
+
 ## obj web_settings
 
 
diff --git a/docs/4.x/redis_cluster.md b/docs/4.x/redis_cluster.md
new file mode 100644
index 00000000..1ae9531e
--- /dev/null
+++ b/docs/4.x/redis_cluster.md
@@ -0,0 +1,349 @@
+---
+permalink: /redis_cluster/
+---
+
+# redis_cluster
+
+`redis_cluster` represents the `google_redis_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAuthorizationMode()`](#fn-withauthorizationmode)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withPscConfigs()`](#fn-withpscconfigs)
+* [`fn withPscConfigsMixin()`](#fn-withpscconfigsmixin)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withReplicaCount()`](#fn-withreplicacount)
+* [`fn withShardCount()`](#fn-withshardcount)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withTransitEncryptionMode()`](#fn-withtransitencryptionmode)
+* [`obj psc_configs`](#obj-psc_configs)
+  * [`fn new()`](#fn-psc_configsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.redis_cluster.new` injects a new `google_redis_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.redis_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.redis_cluster` using the reference:
+
+    $._ref.google_redis_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_redis_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: "AUTH_MODE_DISABLED" Possible values: ["AUTH_MODE_UNSPECIFIED", "AUTH_MODE_IAM_AUTH", "AUTH_MODE_DISABLED"] When `null`, the `authorization_mode` field will be omitted from the resulting object.
+  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:
+projects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.
+  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.
+  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.
+  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.
+If not provided, encryption is disabled for the cluster. Default value: "TRANSIT_ENCRYPTION_MODE_DISABLED" Possible values: ["TRANSIT_ENCRYPTION_MODE_UNSPECIFIED", "TRANSIT_ENCRYPTION_MODE_DISABLED", "TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.
+  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two
+network addresses will be designated to the cluster for client access.
+Currently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.redis_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `redis_cluster`
+Terraform resource.
+
+Unlike [google.redis_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: "AUTH_MODE_DISABLED" Possible values: ["AUTH_MODE_UNSPECIFIED", "AUTH_MODE_IAM_AUTH", "AUTH_MODE_DISABLED"] When `null`, the `authorization_mode` field will be omitted from the resulting object.
+  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:
+projects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.
+  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.
+  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.
+  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.
+If not provided, encryption is disabled for the cluster. Default value: "TRANSIT_ENCRYPTION_MODE_DISABLED" Possible values: ["TRANSIT_ENCRYPTION_MODE_UNSPECIFIED", "TRANSIT_ENCRYPTION_MODE_DISABLED", "TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.
+  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two
+network addresses will be designated to the cluster for client access.
+Currently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_cluster` resource into the root Terraform configuration.
+
+
+### fn withAuthorizationMode
+
+```ts
+withAuthorizationMode()
+```
+
+`google.string.withAuthorizationMode` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the authorization_mode field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `authorization_mode` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withPscConfigs
+
+```ts
+withPscConfigs()
+```
+
+`google.list[obj].withPscConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the psc_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPscConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `psc_configs` field.
+
+
+### fn withPscConfigsMixin
+
+```ts
+withPscConfigsMixin()
+```
+
+`google.list[obj].withPscConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the psc_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPscConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `psc_configs` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withReplicaCount
+
+```ts
+withReplicaCount()
+```
+
+`google.number.withReplicaCount` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the replica_count field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `replica_count` field.
+
+
+### fn withShardCount
+
+```ts
+withShardCount()
+```
+
+`google.number.withShardCount` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the shard_count field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `shard_count` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTransitEncryptionMode
+
+```ts
+withTransitEncryptionMode()
+```
+
+`google.string.withTransitEncryptionMode` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the transit_encryption_mode field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `transit_encryption_mode` field.
+
+
+## obj psc_configs
+
+
+
+### fn psc_configs.new
+
+```ts
+new()
+```
+
+
+`google.redis_cluster.psc_configs.new` constructs a new object with attributes and blocks configured for the `psc_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. The consumer network where the network address of
+the discovery endpoint will be reserved, in the form of
+projects/{network_project_id_or_number}/global/networks/{network_id}.
+
+**Returns**:
+  - An attribute object that represents the `psc_configs` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.redis_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/redis_instance.md b/docs/4.x/redis_instance.md
index f2714902..98157200 100644
--- a/docs/4.x/redis_instance.md
+++ b/docs/4.x/redis_instance.md
@@ -95,7 +95,10 @@ will be used. When `null`, the `authorized_network` field will be omitted from t
   - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis
 instance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,
 the service will choose a zone for the instance. For STANDARD_HA tier,
 instances will be created across two zones for protection against
@@ -177,7 +180,10 @@ will be used. When `null`, the `authorized_network` field will be omitted from t
   - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis
 instance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,
 the service will choose a zone for the instance. For STANDARD_HA tier,
 instances will be created across two zones for protection against
diff --git a/docs/4.x/scc_event_threat_detection_custom_module.md b/docs/4.x/scc_event_threat_detection_custom_module.md
new file mode 100644
index 00000000..f53b6550
--- /dev/null
+++ b/docs/4.x/scc_event_threat_detection_custom_module.md
@@ -0,0 +1,237 @@
+---
+permalink: /scc_event_threat_detection_custom_module/
+---
+
+# scc_event_threat_detection_custom_module
+
+`scc_event_threat_detection_custom_module` represents the `google_scc_event_threat_detection_custom_module` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withConfig()`](#fn-withconfig)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEnablementState()`](#fn-withenablementstate)
+* [`fn withOrganization()`](#fn-withorganization)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.scc_event_threat_detection_custom_module.new` injects a new `google_scc_event_threat_detection_custom_module` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.scc_event_threat_detection_custom_module.new('some_id')
+
+You can get the reference to the `id` field of the created `google.scc_event_threat_detection_custom_module` using the reference:
+
+    $._ref.google_scc_event_threat_detection_custom_module.some_id.get('id')
+
+This is the same as directly entering `"${ google_scc_event_threat_detection_custom_module.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `config` (`string`): Config for the module. For the resident module, its config value is defined at this level.
+For the inherited module, its config value is inherited from the ancestor module.
+  - `display_name` (`string`): The human readable name to be displayed for the module. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `enablement_state` (`string`): The state of enablement for the module at the given level of the hierarchy. Possible values: ["ENABLED", "DISABLED"]
+  - `organization` (`string`): Numerical ID of the parent organization.
+  - `type` (`string`): Immutable. Type for the module. e.g. CONFIGURABLE_BAD_IP.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_event_threat_detection_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.scc_event_threat_detection_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_event_threat_detection_custom_module`
+Terraform resource.
+
+Unlike [google.scc_event_threat_detection_custom_module.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `config` (`string`): Config for the module. For the resident module, its config value is defined at this level.
+For the inherited module, its config value is inherited from the ancestor module.
+  - `display_name` (`string`): The human readable name to be displayed for the module. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `enablement_state` (`string`): The state of enablement for the module at the given level of the hierarchy. Possible values: ["ENABLED", "DISABLED"]
+  - `organization` (`string`): Numerical ID of the parent organization.
+  - `type` (`string`): Immutable. Type for the module. e.g. CONFIGURABLE_BAD_IP.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_event_threat_detection_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_event_threat_detection_custom_module` resource into the root Terraform configuration.
+
+
+### fn withConfig
+
+```ts
+withConfig()
+```
+
+`google.string.withConfig` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the config field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEnablementState
+
+```ts
+withEnablementState()
+```
+
+`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the enablement_state field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `enablement_state` field.
+
+
+### fn withOrganization
+
+```ts
+withOrganization()
+```
+
+`google.string.withOrganization` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the organization field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `organization` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.scc_event_threat_detection_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/scc_folder_custom_module.md b/docs/4.x/scc_folder_custom_module.md
new file mode 100644
index 00000000..c3cfe777
--- /dev/null
+++ b/docs/4.x/scc_folder_custom_module.md
@@ -0,0 +1,421 @@
+---
+permalink: /scc_folder_custom_module/
+---
+
+# scc_folder_custom_module
+
+`scc_folder_custom_module` represents the `google_scc_folder_custom_module` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCustomConfig()`](#fn-withcustomconfig)
+* [`fn withCustomConfigMixin()`](#fn-withcustomconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEnablementState()`](#fn-withenablementstate)
+* [`fn withFolder()`](#fn-withfolder)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj custom_config`](#obj-custom_config)
+  * [`fn new()`](#fn-custom_confignew)
+  * [`obj custom_config.custom_output`](#obj-custom_configcustom_output)
+    * [`fn new()`](#fn-custom_configcustom_outputnew)
+    * [`obj custom_config.custom_output.properties`](#obj-custom_configcustom_outputproperties)
+      * [`fn new()`](#fn-custom_configcustom_outputpropertiesnew)
+      * [`obj custom_config.custom_output.properties.value_expression`](#obj-custom_configcustom_outputpropertiesvalue_expression)
+        * [`fn new()`](#fn-custom_configcustom_outputpropertiesvalue_expressionnew)
+  * [`obj custom_config.predicate`](#obj-custom_configpredicate)
+    * [`fn new()`](#fn-custom_configpredicatenew)
+  * [`obj custom_config.resource_selector`](#obj-custom_configresource_selector)
+    * [`fn new()`](#fn-custom_configresource_selectornew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.new` injects a new `google_scc_folder_custom_module` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.scc_folder_custom_module.new('some_id')
+
+You can get the reference to the `id` field of the created `google.scc_folder_custom_module` using the reference:
+
+    $._ref.google_scc_folder_custom_module.some_id.get('id')
+
+This is the same as directly entering `"${ google_scc_folder_custom_module.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `folder` (`string`): Numerical ID of the parent folder.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.scc_folder_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_folder_custom_module`
+Terraform resource.
+
+Unlike [google.scc_folder_custom_module.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `folder` (`string`): Numerical ID of the parent folder.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_folder_custom_module` resource into the root Terraform configuration.
+
+
+### fn withCustomConfig
+
+```ts
+withCustomConfig()
+```
+
+`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withCustomConfigMixin
+
+```ts
+withCustomConfigMixin()
+```
+
+`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEnablementState
+
+```ts
+withEnablementState()
+```
+
+`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the enablement_state field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `enablement_state` field.
+
+
+### fn withFolder
+
+```ts
+withFolder()
+```
+
+`google.string.withFolder` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the folder field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `folder` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj custom_config
+
+
+
+### fn custom_config.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom
+module detects. This explanation is returned with each finding instance to
+help investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.
+  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve
+the detected issue. This explanation is returned with each finding generated by
+this module in the nextSteps property of the finding JSON.
+  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.
+  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates
+to true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.
+  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module
+can specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_config` sub block.
+
+
+## obj custom_config.custom_output
+
+
+
+### fn custom_config.custom_output.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`
+Terraform sub block.
+
+
+
+**Args**:
+  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_output` sub block.
+
+
+## obj custom_config.custom_output.properties
+
+
+
+### fn custom_config.custom_output.properties.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.
+  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified
+to return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `properties` sub block.
+
+
+## obj custom_config.custom_output.properties.value_expression
+
+
+
+### fn custom_config.custom_output.properties.value_expression.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `value_expression` sub block.
+
+
+## obj custom_config.predicate
+
+
+
+### fn custom_config.predicate.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predicate` sub block.
+
+
+## obj custom_config.resource_selector
+
+
+
+### fn custom_config.resource_selector.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`
+Terraform sub block.
+
+
+
+**Args**:
+  - `resource_types` (`list`): The resource types to run the detector on.
+
+**Returns**:
+  - An attribute object that represents the `resource_selector` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/scc_organization_custom_module.md b/docs/4.x/scc_organization_custom_module.md
new file mode 100644
index 00000000..ffa9d21f
--- /dev/null
+++ b/docs/4.x/scc_organization_custom_module.md
@@ -0,0 +1,421 @@
+---
+permalink: /scc_organization_custom_module/
+---
+
+# scc_organization_custom_module
+
+`scc_organization_custom_module` represents the `google_scc_organization_custom_module` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCustomConfig()`](#fn-withcustomconfig)
+* [`fn withCustomConfigMixin()`](#fn-withcustomconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEnablementState()`](#fn-withenablementstate)
+* [`fn withOrganization()`](#fn-withorganization)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj custom_config`](#obj-custom_config)
+  * [`fn new()`](#fn-custom_confignew)
+  * [`obj custom_config.custom_output`](#obj-custom_configcustom_output)
+    * [`fn new()`](#fn-custom_configcustom_outputnew)
+    * [`obj custom_config.custom_output.properties`](#obj-custom_configcustom_outputproperties)
+      * [`fn new()`](#fn-custom_configcustom_outputpropertiesnew)
+      * [`obj custom_config.custom_output.properties.value_expression`](#obj-custom_configcustom_outputpropertiesvalue_expression)
+        * [`fn new()`](#fn-custom_configcustom_outputpropertiesvalue_expressionnew)
+  * [`obj custom_config.predicate`](#obj-custom_configpredicate)
+    * [`fn new()`](#fn-custom_configpredicatenew)
+  * [`obj custom_config.resource_selector`](#obj-custom_configresource_selector)
+    * [`fn new()`](#fn-custom_configresource_selectornew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.new` injects a new `google_scc_organization_custom_module` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.scc_organization_custom_module.new('some_id')
+
+You can get the reference to the `id` field of the created `google.scc_organization_custom_module` using the reference:
+
+    $._ref.google_scc_organization_custom_module.some_id.get('id')
+
+This is the same as directly entering `"${ google_scc_organization_custom_module.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `organization` (`string`): Numerical ID of the parent organization.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.scc_organization_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_organization_custom_module`
+Terraform resource.
+
+Unlike [google.scc_organization_custom_module.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `organization` (`string`): Numerical ID of the parent organization.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_organization_custom_module` resource into the root Terraform configuration.
+
+
+### fn withCustomConfig
+
+```ts
+withCustomConfig()
+```
+
+`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withCustomConfigMixin
+
+```ts
+withCustomConfigMixin()
+```
+
+`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEnablementState
+
+```ts
+withEnablementState()
+```
+
+`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the enablement_state field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `enablement_state` field.
+
+
+### fn withOrganization
+
+```ts
+withOrganization()
+```
+
+`google.string.withOrganization` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the organization field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `organization` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj custom_config
+
+
+
+### fn custom_config.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom
+module detects. This explanation is returned with each finding instance to
+help investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.
+  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve
+the detected issue. This explanation is returned with each finding generated by
+this module in the nextSteps property of the finding JSON.
+  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.
+  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates
+to true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.
+  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module
+can specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_config` sub block.
+
+
+## obj custom_config.custom_output
+
+
+
+### fn custom_config.custom_output.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`
+Terraform sub block.
+
+
+
+**Args**:
+  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_output` sub block.
+
+
+## obj custom_config.custom_output.properties
+
+
+
+### fn custom_config.custom_output.properties.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.
+  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified
+to return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `properties` sub block.
+
+
+## obj custom_config.custom_output.properties.value_expression
+
+
+
+### fn custom_config.custom_output.properties.value_expression.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `value_expression` sub block.
+
+
+## obj custom_config.predicate
+
+
+
+### fn custom_config.predicate.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predicate` sub block.
+
+
+## obj custom_config.resource_selector
+
+
+
+### fn custom_config.resource_selector.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`
+Terraform sub block.
+
+
+
+**Args**:
+  - `resource_types` (`list`): The resource types to run the detector on.
+
+**Returns**:
+  - An attribute object that represents the `resource_selector` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/secret_manager_secret.md b/docs/4.x/secret_manager_secret.md
index 951cc940..7a666af8 100644
--- a/docs/4.x/secret_manager_secret.md
+++ b/docs/4.x/secret_manager_secret.md
@@ -91,9 +91,14 @@ symbols.
 The total size of annotation keys and values must be less than 16KiB.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `annotations` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
-A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `expire_time` field will be omitted from the resulting object.
+A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+Only one of 'expire_time' or 'ttl' can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels assigned to this Secret.
 
 Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
@@ -105,11 +110,16 @@ and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]
 No more than 64 labels can be assigned to a given resource.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `secret_id` (`string`): This must be unique within the project.
   - `ttl` (`string`): The TTL for the Secret.
-A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `ttl` field will be omitted from the resulting object.
+A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
+Only one of 'ttl' or 'expire_time' can be provided. When `null`, the `ttl` field will be omitted from the resulting object.
   - `version_aliases` (`obj`): Mapping from version alias to version name.
 
 A version alias is a string with a maximum length of 63 characters and can contain
@@ -160,9 +170,14 @@ symbols.
 The total size of annotation keys and values must be less than 16KiB.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `annotations` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
-A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `expire_time` field will be omitted from the resulting object.
+A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+Only one of 'expire_time' or 'ttl' can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels assigned to this Secret.
 
 Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
@@ -174,11 +189,16 @@ and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]
 No more than 64 labels can be assigned to a given resource.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `secret_id` (`string`): This must be unique within the project.
   - `ttl` (`string`): The TTL for the Secret.
-A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `ttl` field will be omitted from the resulting object.
+A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
+Only one of 'ttl' or 'expire_time' can be provided. When `null`, the `ttl` field will be omitted from the resulting object.
   - `version_aliases` (`obj`): Mapping from version alias to version name.
 
 A version alias is a string with a maximum length of 63 characters and can contain
@@ -474,7 +494,6 @@ Terraform sub block.
 
 
 **Args**:
-  - `automatic` (`bool`): The Secret will automatically be replicated without any restrictions. When `null`, the `automatic` field will be omitted from the resulting object.
   - `auto` (`list[obj]`): The Secret will automatically be replicated without any restrictions. When `null`, the `auto` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.auto.new](#fn-replicationautonew) constructor.
   - `user_managed` (`list[obj]`): The Secret will be replicated to the regions specified by the user. When `null`, the `user_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.user_managed.new](#fn-replicationuser_managednew) constructor.
 
diff --git a/docs/4.x/secret_manager_secret_version.md b/docs/4.x/secret_manager_secret_version.md
index 6f9f6b8f..f2321585 100644
--- a/docs/4.x/secret_manager_secret_version.md
+++ b/docs/4.x/secret_manager_secret_version.md
@@ -239,6 +239,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/secure_source_manager_instance.md b/docs/4.x/secure_source_manager_instance.md
new file mode 100644
index 00000000..7be8a111
--- /dev/null
+++ b/docs/4.x/secure_source_manager_instance.md
@@ -0,0 +1,310 @@
+---
+permalink: /secure_source_manager_instance/
+---
+
+# secure_source_manager_instance
+
+`secure_source_manager_instance` represents the `google_secure_source_manager_instance` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withInstanceId()`](#fn-withinstanceid)
+* [`fn withKmsKey()`](#fn-withkmskey)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withPrivateConfig()`](#fn-withprivateconfig)
+* [`fn withPrivateConfigMixin()`](#fn-withprivateconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj private_config`](#obj-private_config)
+  * [`fn new()`](#fn-private_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance.new` injects a new `google_secure_source_manager_instance` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.secure_source_manager_instance.new('some_id')
+
+You can get the reference to the `id` field of the created `google.secure_source_manager_instance` using the reference:
+
+    $._ref.google_secure_source_manager_instance.some_id.get('id')
+
+This is the same as directly entering `"${ google_secure_source_manager_instance.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `instance_id` (`string`): The name for the Instance.
+  - `kms_key` (`string`): Customer-managed encryption key name, in the format projects/*/locations/*/keyRings/*/cryptoKeys/*. When `null`, the `kms_key` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location for the Instance.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `private_config` (`list[obj]`): Private settings for private instance. When `null`, the `private_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.private_config.new](#fn-private_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.secure_source_manager_instance.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance`
+Terraform resource.
+
+Unlike [google.secure_source_manager_instance.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `instance_id` (`string`): The name for the Instance.
+  - `kms_key` (`string`): Customer-managed encryption key name, in the format projects/*/locations/*/keyRings/*/cryptoKeys/*. When `null`, the `kms_key` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels as key value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location for the Instance.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `private_config` (`list[obj]`): Private settings for private instance. When `null`, the `private_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.private_config.new](#fn-private_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance` resource into the root Terraform configuration.
+
+
+### fn withInstanceId
+
+```ts
+withInstanceId()
+```
+
+`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the instance_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `instance_id` field.
+
+
+### fn withKmsKey
+
+```ts
+withKmsKey()
+```
+
+`google.string.withKmsKey` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kms_key field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kms_key` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withPrivateConfig
+
+```ts
+withPrivateConfig()
+```
+
+`google.list[obj].withPrivateConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the private_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPrivateConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `private_config` field.
+
+
+### fn withPrivateConfigMixin
+
+```ts
+withPrivateConfigMixin()
+```
+
+`google.list[obj].withPrivateConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the private_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPrivateConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `private_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj private_config
+
+
+
+### fn private_config.new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance.private_config.new` constructs a new object with attributes and blocks configured for the `private_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ca_pool` (`string`): CA pool resource, resource must in the format of 'projects/{project}/locations/{location}/caPools/{ca_pool}'.
+  - `is_private` (`bool`): 'Indicate if it's private instance.'
+
+**Returns**:
+  - An attribute object that represents the `private_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/secure_source_manager_instance_iam_binding.md b/docs/4.x/secure_source_manager_instance_iam_binding.md
new file mode 100644
index 00000000..432f2f29
--- /dev/null
+++ b/docs/4.x/secure_source_manager_instance_iam_binding.md
@@ -0,0 +1,236 @@
+---
+permalink: /secure_source_manager_instance_iam_binding/
+---
+
+# secure_source_manager_instance_iam_binding
+
+`secure_source_manager_instance_iam_binding` represents the `google_secure_source_manager_instance_iam_binding` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withInstanceId()`](#fn-withinstanceid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMembers()`](#fn-withmembers)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance_iam_binding.new` injects a new `google_secure_source_manager_instance_iam_binding` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.secure_source_manager_instance_iam_binding.new('some_id')
+
+You can get the reference to the `id` field of the created `google.secure_source_manager_instance_iam_binding` using the reference:
+
+    $._ref.google_secure_source_manager_instance_iam_binding.some_id.get('id')
+
+This is the same as directly entering `"${ google_secure_source_manager_instance_iam_binding.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `members` (`list`): Set the `members` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.secure_source_manager_instance_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_binding`
+Terraform resource.
+
+Unlike [google.secure_source_manager_instance_iam_binding.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `members` (`list`): Set the `members` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance_iam_binding` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withInstanceId
+
+```ts
+withInstanceId()
+```
+
+`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the instance_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `instance_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMembers
+
+```ts
+withMembers()
+```
+
+`google.list.withMembers` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the members field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `members` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/secure_source_manager_instance_iam_member.md b/docs/4.x/secure_source_manager_instance_iam_member.md
new file mode 100644
index 00000000..286bb1a1
--- /dev/null
+++ b/docs/4.x/secure_source_manager_instance_iam_member.md
@@ -0,0 +1,236 @@
+---
+permalink: /secure_source_manager_instance_iam_member/
+---
+
+# secure_source_manager_instance_iam_member
+
+`secure_source_manager_instance_iam_member` represents the `google_secure_source_manager_instance_iam_member` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withInstanceId()`](#fn-withinstanceid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMember()`](#fn-withmember)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance_iam_member.new` injects a new `google_secure_source_manager_instance_iam_member` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.secure_source_manager_instance_iam_member.new('some_id')
+
+You can get the reference to the `id` field of the created `google.secure_source_manager_instance_iam_member` using the reference:
+
+    $._ref.google_secure_source_manager_instance_iam_member.some_id.get('id')
+
+This is the same as directly entering `"${ google_secure_source_manager_instance_iam_member.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `member` (`string`): Set the `member` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.secure_source_manager_instance_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_member`
+Terraform resource.
+
+Unlike [google.secure_source_manager_instance_iam_member.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `member` (`string`): Set the `member` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secure_source_manager_instance_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance_iam_member` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withInstanceId
+
+```ts
+withInstanceId()
+```
+
+`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the instance_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `instance_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMember
+
+```ts
+withMember()
+```
+
+`google.string.withMember` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the member field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `member` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/secure_source_manager_instance_iam_policy.md b/docs/4.x/secure_source_manager_instance_iam_policy.md
new file mode 100644
index 00000000..38ff8b26
--- /dev/null
+++ b/docs/4.x/secure_source_manager_instance_iam_policy.md
@@ -0,0 +1,149 @@
+---
+permalink: /secure_source_manager_instance_iam_policy/
+---
+
+# secure_source_manager_instance_iam_policy
+
+`secure_source_manager_instance_iam_policy` represents the `google_secure_source_manager_instance_iam_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withInstanceId()`](#fn-withinstanceid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withPolicyData()`](#fn-withpolicydata)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.secure_source_manager_instance_iam_policy.new` injects a new `google_secure_source_manager_instance_iam_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.secure_source_manager_instance_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.secure_source_manager_instance_iam_policy` using the reference:
+
+    $._ref.google_secure_source_manager_instance_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_secure_source_manager_instance_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.secure_source_manager_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `secure_source_manager_instance_iam_policy`
+Terraform resource.
+
+Unlike [google.secure_source_manager_instance_iam_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `instance_id` (`string`): Set the `instance_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secure_source_manager_instance_iam_policy` resource into the root Terraform configuration.
+
+
+### fn withInstanceId
+
+```ts
+withInstanceId()
+```
+
+`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the instance_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `instance_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withPolicyData
+
+```ts
+withPolicyData()
+```
+
+`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the policy_data field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `policy_data` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/securityposture_posture.md b/docs/4.x/securityposture_posture.md
new file mode 100644
index 00000000..1433fb5b
--- /dev/null
+++ b/docs/4.x/securityposture_posture.md
@@ -0,0 +1,868 @@
+---
+permalink: /securityposture_posture/
+---
+
+# securityposture_posture
+
+`securityposture_posture` represents the `google_securityposture_posture` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withPolicySets()`](#fn-withpolicysets)
+* [`fn withPolicySetsMixin()`](#fn-withpolicysetsmixin)
+* [`fn withPostureId()`](#fn-withpostureid)
+* [`fn withState()`](#fn-withstate)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj policy_sets`](#obj-policy_sets)
+  * [`fn new()`](#fn-policy_setsnew)
+  * [`obj policy_sets.policies`](#obj-policy_setspolicies)
+    * [`fn new()`](#fn-policy_setspoliciesnew)
+    * [`obj policy_sets.policies.compliance_standards`](#obj-policy_setspoliciescompliance_standards)
+      * [`fn new()`](#fn-policy_setspoliciescompliance_standardsnew)
+    * [`obj policy_sets.policies.constraint`](#obj-policy_setspoliciesconstraint)
+      * [`fn new()`](#fn-policy_setspoliciesconstraintnew)
+      * [`obj policy_sets.policies.constraint.org_policy_constraint`](#obj-policy_setspoliciesconstraintorg_policy_constraint)
+        * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraintnew)
+        * [`obj policy_sets.policies.constraint.org_policy_constraint.policy_rules`](#obj-policy_setspoliciesconstraintorg_policy_constraintpolicy_rules)
+          * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraintpolicy_rulesnew)
+          * [`obj policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr`](#obj-policy_setspoliciesconstraintorg_policy_constraintpolicy_rulesexpr)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraintpolicy_rulesexprnew)
+          * [`obj policy_sets.policies.constraint.org_policy_constraint.policy_rules.values`](#obj-policy_setspoliciesconstraintorg_policy_constraintpolicy_rulesvalues)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraintpolicy_rulesvaluesnew)
+      * [`obj policy_sets.policies.constraint.org_policy_constraint_custom`](#obj-policy_setspoliciesconstraintorg_policy_constraint_custom)
+        * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraint_customnew)
+        * [`obj policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint`](#obj-policy_setspoliciesconstraintorg_policy_constraint_customcustom_constraint)
+          * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraint_customcustom_constraintnew)
+        * [`obj policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules`](#obj-policy_setspoliciesconstraintorg_policy_constraint_custompolicy_rules)
+          * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraint_custompolicy_rulesnew)
+          * [`obj policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr`](#obj-policy_setspoliciesconstraintorg_policy_constraint_custompolicy_rulesexpr)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraint_custompolicy_rulesexprnew)
+          * [`obj policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values`](#obj-policy_setspoliciesconstraintorg_policy_constraint_custompolicy_rulesvalues)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintorg_policy_constraint_custompolicy_rulesvaluesnew)
+      * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_module)
+        * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_modulenew)
+        * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module.config`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfig)
+          * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfignew)
+          * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_output)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputnew)
+            * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputproperties)
+              * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputpropertiesnew)
+              * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputpropertiesvalue_expression)
+                * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputpropertiesvalue_expressionnew)
+          * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigpredicate)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigpredicatenew)
+          * [`obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigresource_selector)
+            * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigresource_selectornew)
+      * [`obj policy_sets.policies.constraint.security_health_analytics_module`](#obj-policy_setspoliciesconstraintsecurity_health_analytics_module)
+        * [`fn new()`](#fn-policy_setspoliciesconstraintsecurity_health_analytics_modulenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.new` injects a new `google_securityposture_posture` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.securityposture_posture.new('some_id')
+
+You can get the reference to the `id` field of the created `google.securityposture_posture` using the reference:
+
+    $._ref.google_securityposture_posture.some_id.get('id')
+
+This is the same as directly entering `"${ google_securityposture_posture.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): Description of the posture. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): Location of the resource, eg: global.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `posture_id` (`string`): Id of the posture. It is an immutable field.
+  - `state` (`string`): State of the posture. Update to state field should not be triggered along with
+with other field updates. Possible values: ["DEPRECATED", "DRAFT", "ACTIVE"]
+  - `policy_sets` (`list[obj]`): List of policy sets for the posture. When `null`, the `policy_sets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.new](#fn-policy_setsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.securityposture_posture.newAttrs` constructs a new object with attributes and blocks configured for the `securityposture_posture`
+Terraform resource.
+
+Unlike [google.securityposture_posture.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): Description of the posture. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): Location of the resource, eg: global.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `posture_id` (`string`): Id of the posture. It is an immutable field.
+  - `state` (`string`): State of the posture. Update to state field should not be triggered along with
+with other field updates. Possible values: ["DEPRECATED", "DRAFT", "ACTIVE"]
+  - `policy_sets` (`list[obj]`): List of policy sets for the posture. When `null`, the `policy_sets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.new](#fn-policy_setsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `securityposture_posture` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withPolicySets
+
+```ts
+withPolicySets()
+```
+
+`google.list[obj].withPolicySets` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the policy_sets field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPolicySetsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `policy_sets` field.
+
+
+### fn withPolicySetsMixin
+
+```ts
+withPolicySetsMixin()
+```
+
+`google.list[obj].withPolicySetsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the policy_sets field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPolicySets](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `policy_sets` field.
+
+
+### fn withPostureId
+
+```ts
+withPostureId()
+```
+
+`google.string.withPostureId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the posture_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `posture_id` field.
+
+
+### fn withState
+
+```ts
+withState()
+```
+
+`google.string.withState` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the state field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `state` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj policy_sets
+
+
+
+### fn policy_sets.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.new` constructs a new object with attributes and blocks configured for the `policy_sets`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the policy set. When `null`, the `description` field will be omitted from the resulting object.
+  - `policy_set_id` (`string`): ID of the policy set.
+  - `policies` (`list[obj]`): List of security policy When `null`, the `policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.new](#fn-policy_setspoliciesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_sets` sub block.
+
+
+## obj policy_sets.policies
+
+
+
+### fn policy_sets.policies.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.new` constructs a new object with attributes and blocks configured for the `policies`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the policy. When `null`, the `description` field will be omitted from the resulting object.
+  - `policy_id` (`string`): ID of the policy.
+  - `compliance_standards` (`list[obj]`): Mapping for policy to security standards and controls. When `null`, the `compliance_standards` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.compliance_standards.new](#fn-policy_setspolicy_setscompliance_standardsnew) constructor.
+  - `constraint` (`list[obj]`): Policy constraint definition.It can have the definition of one of following constraints: orgPolicyConstraint orgPolicyConstraintCustom securityHealthAnalyticsModule securityHealthAnalyticsCustomModule When `null`, the `constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.new](#fn-policy_setspolicy_setsconstraintnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policies` sub block.
+
+
+## obj policy_sets.policies.compliance_standards
+
+
+
+### fn policy_sets.policies.compliance_standards.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.compliance_standards.new` constructs a new object with attributes and blocks configured for the `compliance_standards`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control` (`string`): Mapping of security controls for the policy. When `null`, the `control` field will be omitted from the resulting object.
+  - `standard` (`string`): Mapping of compliance standards for the policy. When `null`, the `standard` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `compliance_standards` sub block.
+
+
+## obj policy_sets.policies.constraint
+
+
+
+### fn policy_sets.policies.constraint.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.new` constructs a new object with attributes and blocks configured for the `constraint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `org_policy_constraint` (`list[obj]`): Organization policy canned constraint definition. When `null`, the `org_policy_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.new](#fn-policy_setspolicy_setspoliciesorg_policy_constraintnew) constructor.
+  - `org_policy_constraint_custom` (`list[obj]`): Organization policy custom constraint policy definition. When `null`, the `org_policy_constraint_custom` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.new](#fn-policy_setspolicy_setspoliciesorg_policy_constraint_customnew) constructor.
+  - `security_health_analytics_custom_module` (`list[obj]`): Definition of Security Health Analytics Custom Module. When `null`, the `security_health_analytics_custom_module` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.new](#fn-policy_setspolicy_setspoliciessecurity_health_analytics_custom_modulenew) constructor.
+  - `security_health_analytics_module` (`list[obj]`): Security Health Analytics built-in detector definition. When `null`, the `security_health_analytics_module` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_module.new](#fn-policy_setspolicy_setspoliciessecurity_health_analytics_modulenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `constraint` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.new` constructs a new object with attributes and blocks configured for the `org_policy_constraint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `canned_constraint_id` (`string`): Organization policy canned constraint Id
+  - `policy_rules` (`list[obj]`): Definition of policy rules When `null`, the `policy_rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.new](#fn-policy_setspolicy_setspoliciesconstraintpolicy_rulesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `org_policy_constraint` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint.policy_rules
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint.policy_rules.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.new` constructs a new object with attributes and blocks configured for the `policy_rules`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allow_all` (`bool`): Setting this to true means that all values are allowed. This field can be set only in policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.
+  - `deny_all` (`bool`): Setting this to true means that all values are denied. This field can be set only in policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.
+  - `enforce` (`bool`): If 'true', then the policy is enforced. If 'false', then any configuration is acceptable.
+This field can be set only in policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.
+  - `expr` (`list[obj]`): Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language.
+This page details the objects and attributes that are used to the build the CEL expressions for
+custom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. When `null`, the `expr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraintexprnew) constructor.
+  - `values` (`list[obj]`): List of values to be used for this policy rule. This field can be set only in policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.values.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraintvaluesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_rules` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.expr.new` constructs a new object with attributes and blocks configured for the `expr`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `expr` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint.policy_rules.values
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint.policy_rules.values.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint.policy_rules.values.new` constructs a new object with attributes and blocks configured for the `values`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allowed_values` (`list`): List of values allowed at this resource. When `null`, the `allowed_values` field will be omitted from the resulting object.
+  - `denied_values` (`list`): List of values denied at this resource. When `null`, the `denied_values` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `values` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint_custom
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint_custom.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.new` constructs a new object with attributes and blocks configured for the `org_policy_constraint_custom`
+Terraform sub block.
+
+
+
+**Args**:
+  - `custom_constraint` (`list[obj]`): Organization policy custom constraint definition. When `null`, the `custom_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint.new](#fn-policy_setspolicy_setspoliciesconstraintcustom_constraintnew) constructor.
+  - `policy_rules` (`list[obj]`): Definition of policy rules When `null`, the `policy_rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.new](#fn-policy_setspolicy_setspoliciesconstraintpolicy_rulesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `org_policy_constraint_custom` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.custom_constraint.new` constructs a new object with attributes and blocks configured for the `custom_constraint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]
+  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).
+  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).
+  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.
+  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.
+
+**Returns**:
+  - An attribute object that represents the `custom_constraint` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.new` constructs a new object with attributes and blocks configured for the `policy_rules`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allow_all` (`bool`): Setting this to true means that all values are allowed. This field can be set only in policies for list constraints. When `null`, the `allow_all` field will be omitted from the resulting object.
+  - `deny_all` (`bool`): Setting this to true means that all values are denied. This field can be set only in policies for list constraints. When `null`, the `deny_all` field will be omitted from the resulting object.
+  - `enforce` (`bool`): If 'true', then the policy is enforced. If 'false', then any configuration is acceptable.
+This field can be set only in policies for boolean constraints. When `null`, the `enforce` field will be omitted from the resulting object.
+  - `expr` (`list[obj]`): Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language.
+This page details the objects and attributes that are used to the build the CEL expressions for
+custom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. When `null`, the `expr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraint_customexprnew) constructor.
+  - `values` (`list[obj]`): List of values to be used for this policy rule. This field can be set only in policies for list constraints. When `null`, the `values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values.new](#fn-policy_setspolicy_setspoliciesconstraintorg_policy_constraint_customvaluesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `policy_rules` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.expr.new` constructs a new object with attributes and blocks configured for the `expr`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `expr` sub block.
+
+
+## obj policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values
+
+
+
+### fn policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.org_policy_constraint_custom.policy_rules.values.new` constructs a new object with attributes and blocks configured for the `values`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allowed_values` (`list`): List of values allowed at this resource. When `null`, the `allowed_values` field will be omitted from the resulting object.
+  - `denied_values` (`list`): List of values denied at this resource. When `null`, the `denied_values` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `values` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.new` constructs a new object with attributes and blocks configured for the `security_health_analytics_custom_module`
+Terraform sub block.
+
+
+
+**Args**:
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `module_enablement_state` (`string`): The state of enablement for the module at its level of the resource hierarchy. Possible values: ["ENABLEMENT_STATE_UNSPECIFIED", "ENABLED", "DISABLED"] When `null`, the `module_enablement_state` field will be omitted from the resulting object.
+  - `config` (`list[obj]`): Custom module details. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.new](#fn-policy_setspolicy_setspoliciesconstraintconfignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `security_health_analytics_custom_module` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module.config
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.config.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.new` constructs a new object with attributes and blocks configured for the `config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom
+module detects. When `null`, the `description` field will be omitted from the resulting object.
+  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to
+resolve the detected issue When `null`, the `recommendation` field will be omitted from the resulting object.
+  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["SEVERITY_UNSPECIFIED", "CRITICAL", "HIGH", "MEDIUM", "LOW"]
+  - `custom_output` (`list[obj]`): Custom output properties. A set of optional name-value pairs that define custom source properties to
+return with each finding that is generated by the custom module. The custom
+source properties that are defined here are included in the finding JSON
+under 'sourceProperties'. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_modulecustom_outputnew) constructor.
+  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings.When the expression
+evaluates to true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_modulepredicatenew) constructor.
+  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module
+can specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_moduleresource_selectornew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `config` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`
+Terraform sub block.
+
+
+
+**Args**:
+  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigpropertiesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_output` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the property for the custom output.
+  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be
+specified to return the value of the property or a text string enclosed
+in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression.new](#fn-policy_setspolicy_setspoliciesconstraintsecurity_health_analytics_custom_moduleconfigcustom_outputvalue_expressionnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `properties` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `value_expression` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a file name and a position in the file When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predicate` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_custom_module.config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`
+Terraform sub block.
+
+
+
+**Args**:
+  - `resource_types` (`list`): The resource types to run the detector on.
+
+**Returns**:
+  - An attribute object that represents the `resource_selector` sub block.
+
+
+## obj policy_sets.policies.constraint.security_health_analytics_module
+
+
+
+### fn policy_sets.policies.constraint.security_health_analytics_module.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.policy_sets.policies.constraint.security_health_analytics_module.new` constructs a new object with attributes and blocks configured for the `security_health_analytics_module`
+Terraform sub block.
+
+
+
+**Args**:
+  - `module_enablement_state` (`string`): The state of enablement for the module at its level of the resource hierarchy. Possible values: ["ENABLEMENT_STATE_UNSPECIFIED", "ENABLED", "DISABLED"] When `null`, the `module_enablement_state` field will be omitted from the resulting object.
+  - `module_name` (`string`): The name of the module eg: BIGQUERY_TABLE_CMEK_DISABLED.
+
+**Returns**:
+  - An attribute object that represents the `security_health_analytics_module` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/securityposture_posture_deployment.md b/docs/4.x/securityposture_posture_deployment.md
new file mode 100644
index 00000000..6e6ae3a1
--- /dev/null
+++ b/docs/4.x/securityposture_posture_deployment.md
@@ -0,0 +1,281 @@
+---
+permalink: /securityposture_posture_deployment/
+---
+
+# securityposture_posture_deployment
+
+`securityposture_posture_deployment` represents the `google_securityposture_posture_deployment` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withPostureDeploymentId()`](#fn-withposturedeploymentid)
+* [`fn withPostureId()`](#fn-withpostureid)
+* [`fn withPostureRevisionId()`](#fn-withposturerevisionid)
+* [`fn withTargetResource()`](#fn-withtargetresource)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture_deployment.new` injects a new `google_securityposture_posture_deployment` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.securityposture_posture_deployment.new('some_id')
+
+You can get the reference to the `id` field of the created `google.securityposture_posture_deployment` using the reference:
+
+    $._ref.google_securityposture_posture_deployment.some_id.get('id')
+
+This is the same as directly entering `"${ google_securityposture_posture_deployment.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): Description of the posture deployment. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource, eg. global'.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `posture_deployment_id` (`string`): ID of the posture deployment.
+  - `posture_id` (`string`): Relative name of the posture which needs to be deployed. It should be in the format:
+  organizations/<ORG_ID>/locations/<LOCATION>/postures/<postureID>
+  - `posture_revision_id` (`string`): Revision_id the posture which needs to be deployed.
+  - `target_resource` (`string`): The resource on which the posture should be deployed. This can be in one of the following formats:
+projects/<project_number>
+folders/<folder_number>
+organizations/<organization_id>
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture_deployment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.securityposture_posture_deployment.newAttrs` constructs a new object with attributes and blocks configured for the `securityposture_posture_deployment`
+Terraform resource.
+
+Unlike [google.securityposture_posture_deployment.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): Description of the posture deployment. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource, eg. global'.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `posture_deployment_id` (`string`): ID of the posture deployment.
+  - `posture_id` (`string`): Relative name of the posture which needs to be deployed. It should be in the format:
+  organizations/<ORG_ID>/locations/<LOCATION>/postures/<postureID>
+  - `posture_revision_id` (`string`): Revision_id the posture which needs to be deployed.
+  - `target_resource` (`string`): The resource on which the posture should be deployed. This can be in one of the following formats:
+projects/<project_number>
+folders/<folder_number>
+organizations/<organization_id>
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.securityposture_posture_deployment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `securityposture_posture_deployment` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withPostureDeploymentId
+
+```ts
+withPostureDeploymentId()
+```
+
+`google.string.withPostureDeploymentId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the posture_deployment_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `posture_deployment_id` field.
+
+
+### fn withPostureId
+
+```ts
+withPostureId()
+```
+
+`google.string.withPostureId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the posture_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `posture_id` field.
+
+
+### fn withPostureRevisionId
+
+```ts
+withPostureRevisionId()
+```
+
+`google.string.withPostureRevisionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the posture_revision_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `posture_revision_id` field.
+
+
+### fn withTargetResource
+
+```ts
+withTargetResource()
+```
+
+`google.string.withTargetResource` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the target_resource field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `target_resource` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.securityposture_posture_deployment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/service_account.md b/docs/4.x/service_account.md
index bad539cb..193d9dc4 100644
--- a/docs/4.x/service_account.md
+++ b/docs/4.x/service_account.md
@@ -16,6 +16,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withAccountId()`](#fn-withaccountid)
+* [`fn withCreateIgnoreAlreadyExists()`](#fn-withcreateignorealreadyexists)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisabled()`](#fn-withdisabled)
 * [`fn withDisplayName()`](#fn-withdisplayname)
@@ -55,6 +56,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `account_id` (`string`): The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035. Changing this forces a new service account to be created.
+  - `create_ignore_already_exists` (`bool`): If set to true, skip service account creation if a service account with the same email already exists. When `null`, the `create_ignore_already_exists` field will be omitted from the resulting object.
   - `description` (`string`): A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. When `null`, the `description` field will be omitted from the resulting object.
   - `disabled` (`bool`): Whether the service account is disabled. Defaults to false When `null`, the `disabled` field will be omitted from the resulting object.
   - `display_name` (`string`): The display name for the service account. Can be updated without creating a new resource. When `null`, the `display_name` field will be omitted from the resulting object.
@@ -84,6 +86,7 @@ injecting into a complete block.
 
 **Args**:
   - `account_id` (`string`): The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035. Changing this forces a new service account to be created.
+  - `create_ignore_already_exists` (`bool`): If set to true, skip service account creation if a service account with the same email already exists. When `null`, the `create_ignore_already_exists` field will be omitted from the resulting object.
   - `description` (`string`): A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. When `null`, the `description` field will be omitted from the resulting object.
   - `disabled` (`bool`): Whether the service account is disabled. Defaults to false When `null`, the `disabled` field will be omitted from the resulting object.
   - `display_name` (`string`): The display name for the service account. Can be updated without creating a new resource. When `null`, the `display_name` field will be omitted from the resulting object.
@@ -110,6 +113,22 @@ Terraform resource block to set or update the account_id field.
   - `value` (`string`): The value to set for the `account_id` field.
 
 
+### fn withCreateIgnoreAlreadyExists
+
+```ts
+withCreateIgnoreAlreadyExists()
+```
+
+`google.bool.withCreateIgnoreAlreadyExists` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the create_ignore_already_exists field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `create_ignore_already_exists` field.
+
+
 ### fn withDescription
 
 ```ts
diff --git a/docs/4.x/service_networking_connection.md b/docs/4.x/service_networking_connection.md
index e024791e..ab0f1a50 100644
--- a/docs/4.x/service_networking_connection.md
+++ b/docs/4.x/service_networking_connection.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDeletionPolicy()`](#fn-withdeletionpolicy)
 * [`fn withNetwork()`](#fn-withnetwork)
 * [`fn withReservedPeeringRanges()`](#fn-withreservedpeeringranges)
 * [`fn withService()`](#fn-withservice)
@@ -52,6 +53,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `deletion_policy` (`string`): When set to ABANDON, terraform will abandon management of the resource instead of deleting it. Prevents terraform apply failures with CloudSQL. Note: The resource will still exist. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `network` (`string`): Name of VPC network connected with service producers using VPC peering.
   - `reserved_peering_ranges` (`list`): Named IP address range(s) of PEERING type reserved for this service provider. Note that invoking this method with a different range when connection is already established will not reallocate already provisioned service producer subnetworks.
   - `service` (`string`): Provider peering service that is managing peering connectivity for a service provider organization. For Google services that support this functionality it is 'servicenetworking.googleapis.com'.
@@ -79,6 +81,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `deletion_policy` (`string`): When set to ABANDON, terraform will abandon management of the resource instead of deleting it. Prevents terraform apply failures with CloudSQL. Note: The resource will still exist. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `network` (`string`): Name of VPC network connected with service producers using VPC peering.
   - `reserved_peering_ranges` (`list`): Named IP address range(s) of PEERING type reserved for this service provider. Note that invoking this method with a different range when connection is already established will not reallocate already provisioned service producer subnetworks.
   - `service` (`string`): Provider peering service that is managing peering connectivity for a service provider organization. For Google services that support this functionality it is 'servicenetworking.googleapis.com'.
@@ -88,6 +91,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `service_networking_connection` resource into the root Terraform configuration.
 
 
+### fn withDeletionPolicy
+
+```ts
+withDeletionPolicy()
+```
+
+`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the deletion_policy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `deletion_policy` field.
+
+
 ### fn withNetwork
 
 ```ts
diff --git a/docs/4.x/spanner_instance.md b/docs/4.x/spanner_instance.md
index ba05140b..74279055 100644
--- a/docs/4.x/spanner_instance.md
+++ b/docs/4.x/spanner_instance.md
@@ -15,6 +15,8 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAutoscalingConfig()`](#fn-withautoscalingconfig)
+* [`fn withAutoscalingConfigMixin()`](#fn-withautoscalingconfigmixin)
 * [`fn withConfig()`](#fn-withconfig)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withForceDestroy()`](#fn-withforcedestroy)
@@ -25,6 +27,12 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj autoscaling_config`](#obj-autoscaling_config)
+  * [`fn new()`](#fn-autoscaling_confignew)
+  * [`obj autoscaling_config.autoscaling_limits`](#obj-autoscaling_configautoscaling_limits)
+    * [`fn new()`](#fn-autoscaling_configautoscaling_limitsnew)
+  * [`obj autoscaling_config.autoscaling_targets`](#obj-autoscaling_configautoscaling_targets)
+    * [`fn new()`](#fn-autoscaling_configautoscaling_targetsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -68,7 +76,11 @@ unique per project and between 4 and 30 characters in length.
   - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.
 This must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A unique identifier for the instance, which cannot be changed after
 the instance is created. The name must be between 6 and 30 characters
 in length.
@@ -80,6 +92,10 @@ must be present in terraform. When `null`, the `num_nodes` field will be omitted
   - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units
 or node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `autoscaling_config` (`list[obj]`): The autoscaling configuration. Autoscaling is enabled if this field is set.
+When autoscaling is enabled, num_nodes and processing_units are treated as,
+OUTPUT_ONLY fields and reflect the current compute capacity allocated to
+the instance. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.new](#fn-autoscaling_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -115,7 +131,11 @@ unique per project and between 4 and 30 characters in length.
   - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.
 This must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A unique identifier for the instance, which cannot be changed after
 the instance is created. The name must be between 6 and 30 characters
 in length.
@@ -127,12 +147,53 @@ must be present in terraform. When `null`, the `num_nodes` field will be omitted
   - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units
 or node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `autoscaling_config` (`list[obj]`): The autoscaling configuration. Autoscaling is enabled if this field is set.
+When autoscaling is enabled, num_nodes and processing_units are treated as,
+OUTPUT_ONLY fields and reflect the current compute capacity allocated to
+the instance. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.new](#fn-autoscaling_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `spanner_instance` resource into the root Terraform configuration.
 
 
+### fn withAutoscalingConfig
+
+```ts
+withAutoscalingConfig()
+```
+
+`google.list[obj].withAutoscalingConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the autoscaling_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAutoscalingConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `autoscaling_config` field.
+
+
+### fn withAutoscalingConfigMixin
+
+```ts
+withAutoscalingConfigMixin()
+```
+
+`google.list[obj].withAutoscalingConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the autoscaling_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAutoscalingConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `autoscaling_config` field.
+
+
 ### fn withConfig
 
 ```ts
@@ -297,6 +358,95 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj autoscaling_config
+
+
+
+### fn autoscaling_config.new
+
+```ts
+new()
+```
+
+
+`google.spanner_instance.autoscaling_config.new` constructs a new object with attributes and blocks configured for the `autoscaling_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `autoscaling_limits` (`list[obj]`): Defines scale in controls to reduce the risk of response latency
+and outages due to abrupt scale-in events. Users can define the minimum and
+maximum compute capacity allocated to the instance, and the autoscaler will
+only scale within that range. Users can either use nodes or processing
+units to specify the limits, but should use the same unit to set both the
+min_limit and max_limit. When `null`, the `autoscaling_limits` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.autoscaling_limits.new](#fn-autoscaling_configautoscaling_limitsnew) constructor.
+  - `autoscaling_targets` (`list[obj]`): Defines scale in controls to reduce the risk of response latency
+and outages due to abrupt scale-in events When `null`, the `autoscaling_targets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.autoscaling_config.autoscaling_targets.new](#fn-autoscaling_configautoscaling_targetsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `autoscaling_config` sub block.
+
+
+## obj autoscaling_config.autoscaling_limits
+
+
+
+### fn autoscaling_config.autoscaling_limits.new
+
+```ts
+new()
+```
+
+
+`google.spanner_instance.autoscaling_config.autoscaling_limits.new` constructs a new object with attributes and blocks configured for the `autoscaling_limits`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_nodes` (`number`): Specifies maximum number of nodes allocated to the instance. If set, this number
+should be greater than or equal to min_nodes. When `null`, the `max_nodes` field will be omitted from the resulting object.
+  - `max_processing_units` (`number`): Specifies maximum number of processing units allocated to the instance.
+If set, this number should be multiples of 1000 and be greater than or equal to
+min_processing_units. When `null`, the `max_processing_units` field will be omitted from the resulting object.
+  - `min_nodes` (`number`): Specifies number of nodes allocated to the instance. If set, this number
+should be greater than or equal to 1. When `null`, the `min_nodes` field will be omitted from the resulting object.
+  - `min_processing_units` (`number`): Specifies minimum number of processing units allocated to the instance.
+If set, this number should be multiples of 1000. When `null`, the `min_processing_units` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `autoscaling_limits` sub block.
+
+
+## obj autoscaling_config.autoscaling_targets
+
+
+
+### fn autoscaling_config.autoscaling_targets.new
+
+```ts
+new()
+```
+
+
+`google.spanner_instance.autoscaling_config.autoscaling_targets.new` constructs a new object with attributes and blocks configured for the `autoscaling_targets`
+Terraform sub block.
+
+
+
+**Args**:
+  - `high_priority_cpu_utilization_percent` (`number`): Specifies the target high priority cpu utilization percentage that the autoscaler
+should be trying to achieve for the instance.
+This number is on a scale from 0 (no utilization) to 100 (full utilization).. When `null`, the `high_priority_cpu_utilization_percent` field will be omitted from the resulting object.
+  - `storage_utilization_percent` (`number`): Specifies the target storage utilization percentage that the autoscaler
+should be trying to achieve for the instance.
+This number is on a scale from 0 (no utilization) to 100 (full utilization). When `null`, the `storage_utilization_percent` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `autoscaling_targets` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/sql_database_instance.md b/docs/4.x/sql_database_instance.md
index 489d6ea3..97d927b8 100644
--- a/docs/4.x/sql_database_instance.md
+++ b/docs/4.x/sql_database_instance.md
@@ -527,6 +527,7 @@ Terraform sub block.
   - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.
   - `database_names` (`list`): (SQL Server only, use with point_in_time) clone only the specified databases from the source instance. Clone all databases if empty. When `null`, the `database_names` field will be omitted from the resulting object.
   - `point_in_time` (`string`): The timestamp of the point in time that should be restored. When `null`, the `point_in_time` field will be omitted from the resulting object.
+  - `preferred_zone` (`string`): (Point-in-time recovery for PostgreSQL only) Clone to an instance in the specified zone. If no zone is specified, clone to the same zone as the source instance. When `null`, the `preferred_zone` field will be omitted from the resulting object.
   - `source_instance_name` (`string`): The name of the instance from which the point in time should be restored.
 
 **Returns**:
@@ -863,7 +864,8 @@ Terraform sub block.
   - `enable_private_path_for_google_cloud_services` (`bool`): Whether Google Cloud services such as BigQuery are allowed to access data in this Cloud SQL instance over a private IP connection. SQLSERVER database type is not supported. When `null`, the `enable_private_path_for_google_cloud_services` field will be omitted from the resulting object.
   - `ipv4_enabled` (`bool`): Whether this Cloud SQL instance should be assigned a public IPV4 address. At least ipv4_enabled must be enabled or a private_network must be configured. When `null`, the `ipv4_enabled` field will be omitted from the resulting object.
   - `private_network` (`string`): The VPC network from which the Cloud SQL instance is accessible for private IP. For example, projects/myProject/global/networks/default. Specifying a network enables private IP. At least ipv4_enabled must be enabled or a private_network must be configured. This setting can be updated, but it cannot be removed after it is set. When `null`, the `private_network` field will be omitted from the resulting object.
-  - `require_ssl` (`bool`): Set the `require_ssl` field on the resulting object. When `null`, the `require_ssl` field will be omitted from the resulting object.
+  - `require_ssl` (`bool`): Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in ssl_mode if it has been set too. When `null`, the `require_ssl` field will be omitted from the resulting object.
+  - `ssl_mode` (`string`): Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to require_ssl. To change this field, also set the correspoding value in require_ssl. When `null`, the `ssl_mode` field will be omitted from the resulting object.
   - `authorized_networks` (`list[obj]`): Set the `authorized_networks` field on the resulting object. When `null`, the `authorized_networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_database_instance.settings.ip_configuration.authorized_networks.new](#fn-settingssettingsauthorized_networksnew) constructor.
   - `psc_config` (`list[obj]`): PSC settings for a Cloud SQL instance. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_database_instance.settings.ip_configuration.psc_config.new](#fn-settingssettingspsc_confignew) constructor.
 
diff --git a/docs/4.x/sql_source_representation_instance.md b/docs/4.x/sql_source_representation_instance.md
index 75ff174f..1e3c9b7a 100644
--- a/docs/4.x/sql_source_representation_instance.md
+++ b/docs/4.x/sql_source_representation_instance.md
@@ -66,7 +66,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.
   - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]
   - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.
-  - `host` (`string`): The externally accessible IPv4 address for the source database server.
+  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.
   - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.
   - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.
   - `port` (`number`): The externally accessible port for the source database server.
@@ -104,7 +104,7 @@ injecting into a complete block.
   - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.
   - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]
   - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.
-  - `host` (`string`): The externally accessible IPv4 address for the source database server.
+  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.
   - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.
   - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.
   - `port` (`number`): The externally accessible port for the source database server.
diff --git a/docs/4.x/sql_user.md b/docs/4.x/sql_user.md
index c7b370f6..57617df7 100644
--- a/docs/4.x/sql_user.md
+++ b/docs/4.x/sql_user.md
@@ -70,7 +70,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
                 either CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT. When `null`, the `password` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `type` (`string`): The user type. It determines the method to authenticate the user during login.
-                The default is the database's built-in user type. Flags include "BUILT_IN", "CLOUD_IAM_USER", or "CLOUD_IAM_SERVICE_ACCOUNT". When `null`, the `type` field will be omitted from the resulting object.
+                The default is the database's built-in user type. Flags include "BUILT_IN", "CLOUD_IAM_USER", "CLOUD_IAM_GROUP" or "CLOUD_IAM_SERVICE_ACCOUNT". When `null`, the `type` field will be omitted from the resulting object.
   - `password_policy` (`list[obj]`): Set the `password_policy` field on the resulting resource block. When `null`, the `password_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.password_policy.new](#fn-password_policynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -106,7 +106,7 @@ injecting into a complete block.
                 either CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT. When `null`, the `password` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `type` (`string`): The user type. It determines the method to authenticate the user during login.
-                The default is the database's built-in user type. Flags include "BUILT_IN", "CLOUD_IAM_USER", or "CLOUD_IAM_SERVICE_ACCOUNT". When `null`, the `type` field will be omitted from the resulting object.
+                The default is the database's built-in user type. Flags include "BUILT_IN", "CLOUD_IAM_USER", "CLOUD_IAM_GROUP" or "CLOUD_IAM_SERVICE_ACCOUNT". When `null`, the `type` field will be omitted from the resulting object.
   - `password_policy` (`list[obj]`): Set the `password_policy` field on the resulting object. When `null`, the `password_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.password_policy.new](#fn-password_policynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_user.timeouts.new](#fn-timeoutsnew) constructor.
 
diff --git a/docs/4.x/storage_bucket.md b/docs/4.x/storage_bucket.md
index 299c0592..de560a74 100644
--- a/docs/4.x/storage_bucket.md
+++ b/docs/4.x/storage_bucket.md
@@ -22,6 +22,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCustomPlacementConfig()`](#fn-withcustomplacementconfig)
 * [`fn withCustomPlacementConfigMixin()`](#fn-withcustomplacementconfigmixin)
 * [`fn withDefaultEventBasedHold()`](#fn-withdefaulteventbasedhold)
+* [`fn withEnableObjectRetention()`](#fn-withenableobjectretention)
 * [`fn withEncryption()`](#fn-withencryption)
 * [`fn withEncryptionMixin()`](#fn-withencryptionmixin)
 * [`fn withForceDestroy()`](#fn-withforcedestroy)
@@ -37,6 +38,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRequesterPays()`](#fn-withrequesterpays)
 * [`fn withRetentionPolicy()`](#fn-withretentionpolicy)
 * [`fn withRetentionPolicyMixin()`](#fn-withretentionpolicymixin)
+* [`fn withRpo()`](#fn-withrpo)
 * [`fn withStorageClass()`](#fn-withstorageclass)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
@@ -100,6 +102,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.
+  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.
   - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Google Cloud Storage location
@@ -107,6 +110,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.
   - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.
+  - `rpo` (`string`): Specifies the RPO setting of bucket. If set 'ASYNC_TURBO', The Turbo Replication will be enabled for the dual-region bucket. Value 'DEFAULT' will set RPO setting to default. Turbo Replication is only for buckets in dual-regions.See the docs for more details. When `null`, the `rpo` field will be omitted from the resulting object.
   - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.
   - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.
   - `autoclass` (`list[obj]`): The bucket's autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.
@@ -143,6 +147,7 @@ injecting into a complete block.
 
 **Args**:
   - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.
+  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.
   - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Google Cloud Storage location
@@ -150,6 +155,7 @@ injecting into a complete block.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.
   - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.
+  - `rpo` (`string`): Specifies the RPO setting of bucket. If set 'ASYNC_TURBO', The Turbo Replication will be enabled for the dual-region bucket. Value 'DEFAULT' will set RPO setting to default. Turbo Replication is only for buckets in dual-regions.See the docs for more details. When `null`, the `rpo` field will be omitted from the resulting object.
   - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.
   - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.
   - `autoclass` (`list[obj]`): The bucket's autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.
@@ -294,6 +300,22 @@ Terraform resource block to set or update the default_event_based_hold field.
   - `value` (`bool`): The value to set for the `default_event_based_hold` field.
 
 
+### fn withEnableObjectRetention
+
+```ts
+withEnableObjectRetention()
+```
+
+`google.bool.withEnableObjectRetention` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_object_retention field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_object_retention` field.
+
+
 ### fn withEncryption
 
 ```ts
@@ -554,6 +576,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `retention_policy` field.
 
 
+### fn withRpo
+
+```ts
+withRpo()
+```
+
+`google.string.withRpo` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the rpo field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `rpo` field.
+
+
 ### fn withStorageClass
 
 ```ts
@@ -714,6 +752,7 @@ Terraform sub block.
 
 **Args**:
   - `enabled` (`bool`): While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.
+  - `terminal_storage_class` (`string`): The storage class that objects in the bucket eventually transition to if they are not read for a certain length of time. Supported values include: NEARLINE, ARCHIVE. When `null`, the `terminal_storage_class` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `autoclass` sub block.
@@ -865,6 +904,7 @@ Terraform sub block.
   - `matches_prefix` (`list`): One or more matching name prefixes to satisfy this condition. When `null`, the `matches_prefix` field will be omitted from the resulting object.
   - `matches_storage_class` (`list`): Storage Class of objects to satisfy this condition. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, STANDARD, DURABLE_REDUCED_AVAILABILITY. When `null`, the `matches_storage_class` field will be omitted from the resulting object.
   - `matches_suffix` (`list`): One or more matching name suffixes to satisfy this condition. When `null`, the `matches_suffix` field will be omitted from the resulting object.
+  - `no_age` (`bool`): While set true, age value will be omitted.Required to set true when age is unset in the config file. When `null`, the `no_age` field will be omitted from the resulting object.
   - `noncurrent_time_before` (`string`): Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition. When `null`, the `noncurrent_time_before` field will be omitted from the resulting object.
   - `num_newer_versions` (`number`): Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition. When `null`, the `num_newer_versions` field will be omitted from the resulting object.
   - `with_state` (`string`): Match to live and/or archived objects. Unversioned buckets have only live objects. Supported values include: "LIVE", "ARCHIVED", "ANY". When `null`, the `with_state` field will be omitted from the resulting object.
diff --git a/docs/4.x/storage_bucket_object.md b/docs/4.x/storage_bucket_object.md
index de3761aa..447a616d 100644
--- a/docs/4.x/storage_bucket_object.md
+++ b/docs/4.x/storage_bucket_object.md
@@ -29,6 +29,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withKmsKeyName()`](#fn-withkmskeyname)
 * [`fn withMetadata()`](#fn-withmetadata)
 * [`fn withName()`](#fn-withname)
+* [`fn withRetention()`](#fn-withretention)
+* [`fn withRetentionMixin()`](#fn-withretentionmixin)
 * [`fn withSource()`](#fn-withsource)
 * [`fn withStorageClass()`](#fn-withstorageclass)
 * [`fn withTemporaryHold()`](#fn-withtemporaryhold)
@@ -36,6 +38,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj customer_encryption`](#obj-customer_encryption)
   * [`fn new()`](#fn-customer_encryptionnew)
+* [`obj retention`](#obj-retention)
+  * [`fn new()`](#fn-retentionnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -84,6 +88,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.
   - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.
   - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.
+  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -124,6 +129,7 @@ injecting into a complete block.
   - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.
   - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.
   - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.
+  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -359,6 +365,43 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withRetention
+
+```ts
+withRetention()
+```
+
+`google.list[obj].withRetention` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the retention field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withRetentionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `retention` field.
+
+
+### fn withRetentionMixin
+
+```ts
+withRetentionMixin()
+```
+
+`google.list[obj].withRetentionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the retention field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withRetention](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `retention` field.
+
+
 ### fn withSource
 
 ```ts
@@ -467,6 +510,30 @@ Terraform sub block.
   - An attribute object that represents the `customer_encryption` sub block.
 
 
+## obj retention
+
+
+
+### fn retention.new
+
+```ts
+new()
+```
+
+
+`google.storage_bucket_object.retention.new` constructs a new object with attributes and blocks configured for the `retention`
+Terraform sub block.
+
+
+
+**Args**:
+  - `mode` (`string`): The object retention mode. Supported values include: "Unlocked", "Locked".
+  - `retain_until_time` (`string`): Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.
+
+**Returns**:
+  - An attribute object that represents the `retention` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/storage_transfer_job.md b/docs/4.x/storage_transfer_job.md
index 26346e9e..c2dbeef9 100644
--- a/docs/4.x/storage_transfer_job.md
+++ b/docs/4.x/storage_transfer_job.md
@@ -16,6 +16,9 @@ This package contains functions and utilities for setting up the resource using
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withEventStream()`](#fn-witheventstream)
+* [`fn withEventStreamMixin()`](#fn-witheventstreammixin)
+* [`fn withName()`](#fn-withname)
 * [`fn withNotificationConfig()`](#fn-withnotificationconfig)
 * [`fn withNotificationConfigMixin()`](#fn-withnotificationconfigmixin)
 * [`fn withProject()`](#fn-withproject)
@@ -24,6 +27,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withStatus()`](#fn-withstatus)
 * [`fn withTransferSpec()`](#fn-withtransferspec)
 * [`fn withTransferSpecMixin()`](#fn-withtransferspecmixin)
+* [`obj event_stream`](#obj-event_stream)
+  * [`fn new()`](#fn-event_streamnew)
 * [`obj notification_config`](#obj-notification_config)
   * [`fn new()`](#fn-notification_confignew)
 * [`obj schedule`](#obj-schedule)
@@ -89,8 +94,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Unique description to identify the Transfer Job.
+  - `name` (`string`): The name of the Transfer Job. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.
+  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting resource block. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.
   - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.
   - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.
   - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.
@@ -118,8 +125,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): Unique description to identify the Transfer Job.
+  - `name` (`string`): The name of the Transfer Job. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.
+  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting object. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.
   - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.
   - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.
   - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.
@@ -144,6 +153,59 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withEventStream
+
+```ts
+withEventStream()
+```
+
+`google.list[obj].withEventStream` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the event_stream field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withEventStreamMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `event_stream` field.
+
+
+### fn withEventStreamMixin
+
+```ts
+withEventStreamMixin()
+```
+
+`google.list[obj].withEventStreamMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the event_stream field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withEventStream](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `event_stream` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
 ### fn withNotificationConfig
 
 ```ts
@@ -287,6 +349,31 @@ function.
   - `value` (`list[obj]`): The value to set for the `transfer_spec` field.
 
 
+## obj event_stream
+
+
+
+### fn event_stream.new
+
+```ts
+new()
+```
+
+
+`google.storage_transfer_job.event_stream.new` constructs a new object with attributes and blocks configured for the `event_stream`
+Terraform sub block.
+
+
+
+**Args**:
+  - `event_stream_expiration_time` (`string`): Specifies the data and time at which Storage Transfer Service stops listening for events from this stream. After this time, any transfers in progress will complete, but no new transfers are initiated When `null`, the `event_stream_expiration_time` field will be omitted from the resulting object.
+  - `event_stream_start_time` (`string`): Specifies the date and time that Storage Transfer Service starts listening for events from this stream. If no start time is specified or start time is in the past, Storage Transfer Service starts listening immediately When `null`, the `event_stream_start_time` field will be omitted from the resulting object.
+  - `name` (`string`): Specifies a unique name of the resource such as AWS SQS ARN in the form 'arn:aws:sqs:region:account_id:queue_name', or Pub/Sub subscription resource name in the form 'projects/{project}/subscriptions/{sub}'
+
+**Returns**:
+  - An attribute object that represents the `event_stream` sub block.
+
+
 ## obj notification_config
 
 
diff --git a/docs/4.x/tpu_node.md b/docs/4.x/tpu_node.md
index cb28e678..08afd0aa 100644
--- a/docs/4.x/tpu_node.md
+++ b/docs/4.x/tpu_node.md
@@ -74,7 +74,10 @@ currently existing TPU node, the CIDR block conflicts with any
 subnetworks in the user's provided network, or the provided network
 is peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.
   - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The immutable name of the TPU.
   - `network` (`string`): The name of a network to peer the TPU node to. It must be a
 preexisting Compute Engine network inside of the project on which
@@ -123,7 +126,10 @@ currently existing TPU node, the CIDR block conflicts with any
 subnetworks in the user's provided network, or the provided network
 is peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.
   - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The immutable name of the TPU.
   - `network` (`string`): The name of a network to peer the TPU node to. It must be a
 preexisting Compute Engine network inside of the project on which
diff --git a/docs/4.x/vertex_ai_dataset.md b/docs/4.x/vertex_ai_dataset.md
index 4491a4c2..f476aeba 100644
--- a/docs/4.x/vertex_ai_dataset.md
+++ b/docs/4.x/vertex_ai_dataset.md
@@ -59,7 +59,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
@@ -89,7 +93,11 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/vertex_ai_endpoint.md b/docs/4.x/vertex_ai_endpoint.md
index 94187d32..bb12631f 100644
--- a/docs/4.x/vertex_ai_endpoint.md
+++ b/docs/4.x/vertex_ai_endpoint.md
@@ -63,7 +63,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.
@@ -96,7 +99,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.
diff --git a/docs/4.x/vertex_ai_feature_group.md b/docs/4.x/vertex_ai_feature_group.md
new file mode 100644
index 00000000..202ea8a4
--- /dev/null
+++ b/docs/4.x/vertex_ai_feature_group.md
@@ -0,0 +1,333 @@
+---
+permalink: /vertex_ai_feature_group/
+---
+
+# vertex_ai_feature_group
+
+`vertex_ai_feature_group` represents the `google_vertex_ai_feature_group` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBigQuery()`](#fn-withbigquery)
+* [`fn withBigQueryMixin()`](#fn-withbigquerymixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj big_query`](#obj-big_query)
+  * [`fn new()`](#fn-big_querynew)
+  * [`obj big_query.big_query_source`](#obj-big_querybig_query_source)
+    * [`fn new()`](#fn-big_querybig_query_sourcenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_group.new` injects a new `google_vertex_ai_feature_group` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vertex_ai_feature_group.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vertex_ai_feature_group` using the reference:
+
+    $._ref.google_vertex_ai_feature_group.some_id.get('id')
+
+This is the same as directly entering `"${ google_vertex_ai_feature_group.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the Feature Group. When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region of feature group. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
+  - `big_query` (`list[obj]`): Indicates that features for this group come from BigQuery Table/View. By default treats the source as a sparse time series source, which is required to have an entityId and a feature_timestamp column in the source. When `null`, the `big_query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.big_query.new](#fn-big_querynew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vertex_ai_feature_group.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_group`
+Terraform resource.
+
+Unlike [google.vertex_ai_feature_group.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the Feature Group. When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region of feature group. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
+  - `big_query` (`list[obj]`): Indicates that features for this group come from BigQuery Table/View. By default treats the source as a sparse time series source, which is required to have an entityId and a feature_timestamp column in the source. When `null`, the `big_query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.big_query.new](#fn-big_querynew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_group` resource into the root Terraform configuration.
+
+
+### fn withBigQuery
+
+```ts
+withBigQuery()
+```
+
+`google.list[obj].withBigQuery` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the big_query field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBigQueryMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `big_query` field.
+
+
+### fn withBigQueryMixin
+
+```ts
+withBigQueryMixin()
+```
+
+`google.list[obj].withBigQueryMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the big_query field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBigQuery](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `big_query` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj big_query
+
+
+
+### fn big_query.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_group.big_query.new` constructs a new object with attributes and blocks configured for the `big_query`
+Terraform sub block.
+
+
+
+**Args**:
+  - `entity_id_columns` (`list`): Columns to construct entityId / row keys. Currently only supports 1 entity_id_column. If not provided defaults to entityId. When `null`, the `entity_id_columns` field will be omitted from the resulting object.
+  - `big_query_source` (`list[obj]`): The BigQuery source URI that points to either a BigQuery Table or View. When `null`, the `big_query_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group.big_query.big_query_source.new](#fn-big_querybig_query_sourcenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `big_query` sub block.
+
+
+## obj big_query.big_query_source
+
+
+
+### fn big_query.big_query_source.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_group.big_query.big_query_source.new` constructs a new object with attributes and blocks configured for the `big_query_source`
+Terraform sub block.
+
+
+
+**Args**:
+  - `input_uri` (`string`): BigQuery URI to a table, up to 2000 characters long. For example: 'bq://projectId.bqDatasetId.bqTableId.'
+
+**Returns**:
+  - An attribute object that represents the `big_query_source` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_group.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vertex_ai_feature_group_feature.md b/docs/4.x/vertex_ai_feature_group_feature.md
new file mode 100644
index 00000000..8c61dfe4
--- /dev/null
+++ b/docs/4.x/vertex_ai_feature_group_feature.md
@@ -0,0 +1,279 @@
+---
+permalink: /vertex_ai_feature_group_feature/
+---
+
+# vertex_ai_feature_group_feature
+
+`vertex_ai_feature_group_feature` represents the `google_vertex_ai_feature_group_feature` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withFeatureGroup()`](#fn-withfeaturegroup)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVersionColumnName()`](#fn-withversioncolumnname)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_group_feature.new` injects a new `google_vertex_ai_feature_group_feature` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vertex_ai_feature_group_feature.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vertex_ai_feature_group_feature` using the reference:
+
+    $._ref.google_vertex_ai_feature_group_feature.some_id.get('id')
+
+This is the same as directly entering `"${ google_vertex_ai_feature_group_feature.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.
+  - `feature_group` (`string`): The name of the Feature Group.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the Feature Group Feature.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region for the resource. It should be the same as the feature group's region.
+  - `version_column_name` (`string`): The name of the BigQuery Table/View column hosting data for this version. If no value is provided, will use featureId. When `null`, the `version_column_name` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group_feature.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vertex_ai_feature_group_feature.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_group_feature`
+Terraform resource.
+
+Unlike [google.vertex_ai_feature_group_feature.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): The description of the FeatureGroup. When `null`, the `description` field will be omitted from the resulting object.
+  - `feature_group` (`string`): The name of the Feature Group.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your FeatureGroup.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the Feature Group Feature.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region for the resource. It should be the same as the feature group's region.
+  - `version_column_name` (`string`): The name of the BigQuery Table/View column hosting data for this version. If no value is provided, will use featureId. When `null`, the `version_column_name` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_group_feature.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_group_feature` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withFeatureGroup
+
+```ts
+withFeatureGroup()
+```
+
+`google.string.withFeatureGroup` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the feature_group field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `feature_group` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVersionColumnName
+
+```ts
+withVersionColumnName()
+```
+
+`google.string.withVersionColumnName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the version_column_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `version_column_name` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_group_feature.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vertex_ai_feature_online_store.md b/docs/4.x/vertex_ai_feature_online_store.md
new file mode 100644
index 00000000..f80c0c0d
--- /dev/null
+++ b/docs/4.x/vertex_ai_feature_online_store.md
@@ -0,0 +1,334 @@
+---
+permalink: /vertex_ai_feature_online_store/
+---
+
+# vertex_ai_feature_online_store
+
+`vertex_ai_feature_online_store` represents the `google_vertex_ai_feature_online_store` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBigtable()`](#fn-withbigtable)
+* [`fn withBigtableMixin()`](#fn-withbigtablemixin)
+* [`fn withForceDestroy()`](#fn-withforcedestroy)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj bigtable`](#obj-bigtable)
+  * [`fn new()`](#fn-bigtablenew)
+  * [`obj bigtable.auto_scaling`](#obj-bigtableauto_scaling)
+    * [`fn new()`](#fn-bigtableauto_scalingnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store.new` injects a new `google_vertex_ai_feature_online_store` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vertex_ai_feature_online_store.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vertex_ai_feature_online_store` using the reference:
+
+    $._ref.google_vertex_ai_feature_online_store.some_id.get('id')
+
+This is the same as directly entering `"${ google_vertex_ai_feature_online_store.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `force_destroy` (`bool`): If set to true, any FeatureViews and Features for this FeatureOnlineStore will also be deleted. When `null`, the `force_destroy` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your feature online stores.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the Feature Online Store. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region of feature online store. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
+  - `bigtable` (`list[obj]`): Settings for Cloud Bigtable instance that will be created to serve featureValues for all FeatureViews under this FeatureOnlineStore. When `null`, the `bigtable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.bigtable.new](#fn-bigtablenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vertex_ai_feature_online_store.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_online_store`
+Terraform resource.
+
+Unlike [google.vertex_ai_feature_online_store.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `force_destroy` (`bool`): If set to true, any FeatureViews and Features for this FeatureOnlineStore will also be deleted. When `null`, the `force_destroy` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your feature online stores.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the Feature Online Store. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region of feature online store. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
+  - `bigtable` (`list[obj]`): Settings for Cloud Bigtable instance that will be created to serve featureValues for all FeatureViews under this FeatureOnlineStore. When `null`, the `bigtable` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.bigtable.new](#fn-bigtablenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_online_store` resource into the root Terraform configuration.
+
+
+### fn withBigtable
+
+```ts
+withBigtable()
+```
+
+`google.list[obj].withBigtable` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the bigtable field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBigtableMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `bigtable` field.
+
+
+### fn withBigtableMixin
+
+```ts
+withBigtableMixin()
+```
+
+`google.list[obj].withBigtableMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the bigtable field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBigtable](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `bigtable` field.
+
+
+### fn withForceDestroy
+
+```ts
+withForceDestroy()
+```
+
+`google.bool.withForceDestroy` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the force_destroy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `force_destroy` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj bigtable
+
+
+
+### fn bigtable.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store.bigtable.new` constructs a new object with attributes and blocks configured for the `bigtable`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_scaling` (`list[obj]`): Autoscaling config applied to Bigtable Instance. When `null`, the `auto_scaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store.bigtable.auto_scaling.new](#fn-bigtableauto_scalingnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `bigtable` sub block.
+
+
+## obj bigtable.auto_scaling
+
+
+
+### fn bigtable.auto_scaling.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store.bigtable.auto_scaling.new` constructs a new object with attributes and blocks configured for the `auto_scaling`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cpu_utilization_target` (`number`): A percentage of the cluster's CPU capacity. Can be from 10% to 80%. When a cluster's CPU utilization exceeds the target that you have set, Bigtable immediately adds nodes to the cluster. When CPU utilization is substantially lower than the target, Bigtable removes nodes. If not set will default to 50%. When `null`, the `cpu_utilization_target` field will be omitted from the resulting object.
+  - `max_node_count` (`number`): The maximum number of nodes to scale up to. Must be greater than or equal to minNodeCount, and less than or equal to 10 times of 'minNodeCount'.
+  - `min_node_count` (`number`): The minimum number of nodes to scale down to. Must be greater than or equal to 1.
+
+**Returns**:
+  - An attribute object that represents the `auto_scaling` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vertex_ai_feature_online_store_featureview.md b/docs/4.x/vertex_ai_feature_online_store_featureview.md
new file mode 100644
index 00000000..73a390cc
--- /dev/null
+++ b/docs/4.x/vertex_ai_feature_online_store_featureview.md
@@ -0,0 +1,377 @@
+---
+permalink: /vertex_ai_feature_online_store_featureview/
+---
+
+# vertex_ai_feature_online_store_featureview
+
+`vertex_ai_feature_online_store_featureview` represents the `google_vertex_ai_feature_online_store_featureview` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBigQuerySource()`](#fn-withbigquerysource)
+* [`fn withBigQuerySourceMixin()`](#fn-withbigquerysourcemixin)
+* [`fn withFeatureOnlineStore()`](#fn-withfeatureonlinestore)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withSyncConfig()`](#fn-withsyncconfig)
+* [`fn withSyncConfigMixin()`](#fn-withsyncconfigmixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj big_query_source`](#obj-big_query_source)
+  * [`fn new()`](#fn-big_query_sourcenew)
+* [`obj sync_config`](#obj-sync_config)
+  * [`fn new()`](#fn-sync_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store_featureview.new` injects a new `google_vertex_ai_feature_online_store_featureview` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vertex_ai_feature_online_store_featureview.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vertex_ai_feature_online_store_featureview` using the reference:
+
+    $._ref.google_vertex_ai_feature_online_store_featureview.some_id.get('id')
+
+This is the same as directly entering `"${ google_vertex_ai_feature_online_store_featureview.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `feature_online_store` (`string`): The name of the FeatureOnlineStore to use for the featureview.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this FeatureView.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the FeatureView. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region for the resource. It should be the same as the featureonlinestore region.
+  - `big_query_source` (`list[obj]`): Configures how data is supposed to be extracted from a BigQuery source to be loaded onto the FeatureOnlineStore. When `null`, the `big_query_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.big_query_source.new](#fn-big_query_sourcenew) constructor.
+  - `sync_config` (`list[obj]`): Configures when data is to be synced/updated for this FeatureView. At the end of the sync the latest featureValues for each entityId of this FeatureView are made ready for online serving. When `null`, the `sync_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.sync_config.new](#fn-sync_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vertex_ai_feature_online_store_featureview.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_feature_online_store_featureview`
+Terraform resource.
+
+Unlike [google.vertex_ai_feature_online_store_featureview.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `feature_online_store` (`string`): The name of the FeatureOnlineStore to use for the featureview.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this FeatureView.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the FeatureView. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The region for the resource. It should be the same as the featureonlinestore region.
+  - `big_query_source` (`list[obj]`): Configures how data is supposed to be extracted from a BigQuery source to be loaded onto the FeatureOnlineStore. When `null`, the `big_query_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.big_query_source.new](#fn-big_query_sourcenew) constructor.
+  - `sync_config` (`list[obj]`): Configures when data is to be synced/updated for this FeatureView. At the end of the sync the latest featureValues for each entityId of this FeatureView are made ready for online serving. When `null`, the `sync_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.sync_config.new](#fn-sync_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_feature_online_store_featureview.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_feature_online_store_featureview` resource into the root Terraform configuration.
+
+
+### fn withBigQuerySource
+
+```ts
+withBigQuerySource()
+```
+
+`google.list[obj].withBigQuerySource` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the big_query_source field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBigQuerySourceMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `big_query_source` field.
+
+
+### fn withBigQuerySourceMixin
+
+```ts
+withBigQuerySourceMixin()
+```
+
+`google.list[obj].withBigQuerySourceMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the big_query_source field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBigQuerySource](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `big_query_source` field.
+
+
+### fn withFeatureOnlineStore
+
+```ts
+withFeatureOnlineStore()
+```
+
+`google.string.withFeatureOnlineStore` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the feature_online_store field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `feature_online_store` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withSyncConfig
+
+```ts
+withSyncConfig()
+```
+
+`google.list[obj].withSyncConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the sync_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSyncConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `sync_config` field.
+
+
+### fn withSyncConfigMixin
+
+```ts
+withSyncConfigMixin()
+```
+
+`google.list[obj].withSyncConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the sync_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSyncConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `sync_config` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj big_query_source
+
+
+
+### fn big_query_source.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store_featureview.big_query_source.new` constructs a new object with attributes and blocks configured for the `big_query_source`
+Terraform sub block.
+
+
+
+**Args**:
+  - `entity_id_columns` (`list`): Columns to construct entityId / row keys. Start by supporting 1 only.
+  - `uri` (`string`): The BigQuery view URI that will be materialized on each sync trigger based on FeatureView.SyncConfig.
+
+**Returns**:
+  - An attribute object that represents the `big_query_source` sub block.
+
+
+## obj sync_config
+
+
+
+### fn sync_config.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store_featureview.sync_config.new` constructs a new object with attributes and blocks configured for the `sync_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cron` (`string`): Cron schedule (https://en.wikipedia.org/wiki/Cron) to launch scheduled runs.
+To explicitly set a timezone to the cron tab, apply a prefix in the cron tab: "CRON_TZ=${IANA_TIME_ZONE}" or "TZ=${IANA_TIME_ZONE}". When `null`, the `cron` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sync_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_feature_online_store_featureview.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vertex_ai_featurestore.md b/docs/4.x/vertex_ai_featurestore.md
index 1cde68e7..d3915f5d 100644
--- a/docs/4.x/vertex_ai_featurestore.md
+++ b/docs/4.x/vertex_ai_featurestore.md
@@ -65,7 +65,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
@@ -96,7 +100,11 @@ injecting into a complete block.
 
 **Args**:
   - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/vertex_ai_featurestore_entitytype.md b/docs/4.x/vertex_ai_featurestore_entitytype.md
index 252337e2..0abd11c5 100644
--- a/docs/4.x/vertex_ai_featurestore_entitytype.md
+++ b/docs/4.x/vertex_ai_featurestore_entitytype.md
@@ -67,7 +67,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.
   - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.
 
@@ -98,7 +102,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.
   - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.
 
diff --git a/docs/4.x/vertex_ai_featurestore_entitytype_feature.md b/docs/4.x/vertex_ai_featurestore_entitytype_feature.md
index 0fb8699f..3aa9bcbd 100644
--- a/docs/4.x/vertex_ai_featurestore_entitytype_feature.md
+++ b/docs/4.x/vertex_ai_featurestore_entitytype_feature.md
@@ -56,7 +56,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.
   - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.
   - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.
@@ -85,7 +89,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.
   - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.
   - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/vertex_ai_index.md b/docs/4.x/vertex_ai_index.md
index 166793c2..253605dd 100644
--- a/docs/4.x/vertex_ai_index.md
+++ b/docs/4.x/vertex_ai_index.md
@@ -72,7 +72,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.
 * BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.
 * STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.
@@ -105,7 +108,10 @@ injecting into a complete block.
   - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.
 * BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.
 * STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.
@@ -306,7 +312,7 @@ The string must be a valid Cloud Storage directory path. If this
 field is set when calling IndexService.UpdateIndex, then no other
 Index field can be also updated as part of the same call.
 The expected structure and format of the files this URI points to is
-described at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format When `null`, the `contents_delta_uri` field will be omitted from the resulting object.
+described at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format
   - `is_complete_overwrite` (`bool`): If this field is set together with contentsDeltaUri when calling IndexService.UpdateIndex,
 then existing content of the Index will be replaced by the data from the contentsDeltaUri. When `null`, the `is_complete_overwrite` field will be omitted from the resulting object.
   - `config` (`list[obj]`): The configuration of the Matching Engine Index. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.config.new](#fn-metadataconfignew) constructor.
diff --git a/docs/4.x/vertex_ai_index_endpoint.md b/docs/4.x/vertex_ai_index_endpoint.md
index 481d46d2..68dbd706 100644
--- a/docs/4.x/vertex_ai_index_endpoint.md
+++ b/docs/4.x/vertex_ai_index_endpoint.md
@@ -19,11 +19,15 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withNetwork()`](#fn-withnetwork)
+* [`fn withPrivateServiceConnectConfig()`](#fn-withprivateserviceconnectconfig)
+* [`fn withPrivateServiceConnectConfigMixin()`](#fn-withprivateserviceconnectconfigmixin)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withPublicEndpointEnabled()`](#fn-withpublicendpointenabled)
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj private_service_connect_config`](#obj-private_service_connect_config)
+  * [`fn new()`](#fn-private_service_connect_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -58,7 +62,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.
 Private services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.
 [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.
@@ -66,6 +73,7 @@ Where '{project}' is a project number, as in '12345', and '{
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.
   - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
+  - `private_service_connect_config` (`list[obj]`): Optional. Configuration for private service connect. 'network' and 'privateServiceConnectConfig' are mutually exclusive. When `null`, the `private_service_connect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.private_service_connect_config.new](#fn-private_service_connect_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -92,7 +100,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.
 Private services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.
 [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.
@@ -100,6 +111,7 @@ Where '{project}' is a project number, as in '12345', and '{
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.
   - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
+  - `private_service_connect_config` (`list[obj]`): Optional. Configuration for private service connect. 'network' and 'privateServiceConnectConfig' are mutually exclusive. When `null`, the `private_service_connect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.private_service_connect_config.new](#fn-private_service_connect_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -170,6 +182,43 @@ Terraform resource block to set or update the network field.
   - `value` (`string`): The value to set for the `network` field.
 
 
+### fn withPrivateServiceConnectConfig
+
+```ts
+withPrivateServiceConnectConfig()
+```
+
+`google.list[obj].withPrivateServiceConnectConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the private_service_connect_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPrivateServiceConnectConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `private_service_connect_config` field.
+
+
+### fn withPrivateServiceConnectConfigMixin
+
+```ts
+withPrivateServiceConnectConfigMixin()
+```
+
+`google.list[obj].withPrivateServiceConnectConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the private_service_connect_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPrivateServiceConnectConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `private_service_connect_config` field.
+
+
 ### fn withProject
 
 ```ts
@@ -254,6 +303,30 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj private_service_connect_config
+
+
+
+### fn private_service_connect_config.new
+
+```ts
+new()
+```
+
+
+`google.vertex_ai_index_endpoint.private_service_connect_config.new` constructs a new object with attributes and blocks configured for the `private_service_connect_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enable_private_service_connect` (`bool`): If set to true, the IndexEndpoint is created without private service access.
+  - `project_allowlist` (`list`): A list of Projects from which the forwarding rule will target the service attachment. When `null`, the `project_allowlist` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `private_service_connect_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/vertex_ai_tensorboard.md b/docs/4.x/vertex_ai_tensorboard.md
index 5a1fc20c..ba435e7a 100644
--- a/docs/4.x/vertex_ai_tensorboard.md
+++ b/docs/4.x/vertex_ai_tensorboard.md
@@ -60,7 +60,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User provided name of this Tensorboard.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.
@@ -90,7 +94,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User provided name of this Tensorboard.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.
diff --git a/docs/4.x/vmwareengine_cluster.md b/docs/4.x/vmwareengine_cluster.md
new file mode 100644
index 00000000..b3349fcb
--- /dev/null
+++ b/docs/4.x/vmwareengine_cluster.md
@@ -0,0 +1,255 @@
+---
+permalink: /vmwareengine_cluster/
+---
+
+# vmwareengine_cluster
+
+`vmwareengine_cluster` represents the `google_vmwareengine_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodeTypeConfigs()`](#fn-withnodetypeconfigs)
+* [`fn withNodeTypeConfigsMixin()`](#fn-withnodetypeconfigsmixin)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj node_type_configs`](#obj-node_type_configs)
+  * [`fn new()`](#fn-node_type_configsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_cluster.new` injects a new `google_vmwareengine_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_cluster` using the reference:
+
+    $._ref.google_vmwareengine_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `name` (`string`): The ID of the Cluster.
+  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+  - `node_type_configs` (`list[obj]`): The map of cluster node types in this cluster,
+where the key is canonical identifier of the node type (corresponds to the NodeType). When `null`, the `node_type_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.node_type_configs.new](#fn-node_type_configsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_cluster`
+Terraform resource.
+
+Unlike [google.vmwareengine_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `name` (`string`): The ID of the Cluster.
+  - `parent` (`string`): The resource name of the private cloud to create a new cluster in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+  - `node_type_configs` (`list[obj]`): The map of cluster node types in this cluster,
+where the key is canonical identifier of the node type (corresponds to the NodeType). When `null`, the `node_type_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.node_type_configs.new](#fn-node_type_configsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_cluster` resource into the root Terraform configuration.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodeTypeConfigs
+
+```ts
+withNodeTypeConfigs()
+```
+
+`google.list[obj].withNodeTypeConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_type_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeTypeConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_type_configs` field.
+
+
+### fn withNodeTypeConfigsMixin
+
+```ts
+withNodeTypeConfigsMixin()
+```
+
+`google.list[obj].withNodeTypeConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_type_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeTypeConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_type_configs` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj node_type_configs
+
+
+
+### fn node_type_configs.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_cluster.node_type_configs.new` constructs a new object with attributes and blocks configured for the `node_type_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `custom_core_count` (`number`): Customized number of cores available to each node of the type.
+This number must always be one of 'nodeType.availableCustomCoreCounts'.
+If zero is provided max value from 'nodeType.availableCustomCoreCounts' will be used.
+Once the customer is created then corecount cannot be changed. When `null`, the `custom_core_count` field will be omitted from the resulting object.
+  - `node_count` (`number`): The number of nodes of this type in the cluster.
+  - `node_type_id` (`string`): Set the `node_type_id` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_type_configs` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_external_access_rule.md b/docs/4.x/vmwareengine_external_access_rule.md
new file mode 100644
index 00000000..d8973dfe
--- /dev/null
+++ b/docs/4.x/vmwareengine_external_access_rule.md
@@ -0,0 +1,434 @@
+---
+permalink: /vmwareengine_external_access_rule/
+---
+
+# vmwareengine_external_access_rule
+
+`vmwareengine_external_access_rule` represents the `google_vmwareengine_external_access_rule` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAction()`](#fn-withaction)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDestinationIpRanges()`](#fn-withdestinationipranges)
+* [`fn withDestinationIpRangesMixin()`](#fn-withdestinationiprangesmixin)
+* [`fn withDestinationPorts()`](#fn-withdestinationports)
+* [`fn withIpProtocol()`](#fn-withipprotocol)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withPriority()`](#fn-withpriority)
+* [`fn withSourceIpRanges()`](#fn-withsourceipranges)
+* [`fn withSourceIpRangesMixin()`](#fn-withsourceiprangesmixin)
+* [`fn withSourcePorts()`](#fn-withsourceports)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj destination_ip_ranges`](#obj-destination_ip_ranges)
+  * [`fn new()`](#fn-destination_ip_rangesnew)
+* [`obj source_ip_ranges`](#obj-source_ip_ranges)
+  * [`fn new()`](#fn-source_ip_rangesnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_external_access_rule.new` injects a new `google_vmwareengine_external_access_rule` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_external_access_rule.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_external_access_rule` using the reference:
+
+    $._ref.google_vmwareengine_external_access_rule.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_external_access_rule.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `action` (`string`): The action that the external access rule performs. Possible values: ["ALLOW", "DENY"]
+  - `description` (`string`): User-provided description for the external access rule. When `null`, the `description` field will be omitted from the resulting object.
+  - `destination_ports` (`list`): A list of destination ports to which the external access rule applies.
+  - `ip_protocol` (`string`): The IP protocol to which the external access rule applies.
+  - `name` (`string`): The ID of the external access rule.
+  - `parent` (`string`): The resource name of the network policy.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy
+  - `priority` (`number`): External access rule priority, which determines the external access rule to use when multiple rules apply.
+  - `source_ports` (`list`): A list of source ports to which the external access rule applies.
+  - `destination_ip_ranges` (`list[obj]`): If destination ranges are specified, the external access rule applies only to
+traffic that has a destination IP address in these ranges. When `null`, the `destination_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.destination_ip_ranges.new](#fn-destination_ip_rangesnew) constructor.
+  - `source_ip_ranges` (`list[obj]`): If source ranges are specified, the external access rule applies only to
+traffic that has a source IP address in these ranges. When `null`, the `source_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.source_ip_ranges.new](#fn-source_ip_rangesnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_external_access_rule.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_access_rule`
+Terraform resource.
+
+Unlike [google.vmwareengine_external_access_rule.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `action` (`string`): The action that the external access rule performs. Possible values: ["ALLOW", "DENY"]
+  - `description` (`string`): User-provided description for the external access rule. When `null`, the `description` field will be omitted from the resulting object.
+  - `destination_ports` (`list`): A list of destination ports to which the external access rule applies.
+  - `ip_protocol` (`string`): The IP protocol to which the external access rule applies.
+  - `name` (`string`): The ID of the external access rule.
+  - `parent` (`string`): The resource name of the network policy.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy
+  - `priority` (`number`): External access rule priority, which determines the external access rule to use when multiple rules apply.
+  - `source_ports` (`list`): A list of source ports to which the external access rule applies.
+  - `destination_ip_ranges` (`list[obj]`): If destination ranges are specified, the external access rule applies only to
+traffic that has a destination IP address in these ranges. When `null`, the `destination_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.destination_ip_ranges.new](#fn-destination_ip_rangesnew) constructor.
+  - `source_ip_ranges` (`list[obj]`): If source ranges are specified, the external access rule applies only to
+traffic that has a source IP address in these ranges. When `null`, the `source_ip_ranges` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.source_ip_ranges.new](#fn-source_ip_rangesnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_access_rule.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_external_access_rule` resource into the root Terraform configuration.
+
+
+### fn withAction
+
+```ts
+withAction()
+```
+
+`google.string.withAction` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the action field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `action` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDestinationIpRanges
+
+```ts
+withDestinationIpRanges()
+```
+
+`google.list[obj].withDestinationIpRanges` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the destination_ip_ranges field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDestinationIpRangesMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `destination_ip_ranges` field.
+
+
+### fn withDestinationIpRangesMixin
+
+```ts
+withDestinationIpRangesMixin()
+```
+
+`google.list[obj].withDestinationIpRangesMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the destination_ip_ranges field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDestinationIpRanges](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `destination_ip_ranges` field.
+
+
+### fn withDestinationPorts
+
+```ts
+withDestinationPorts()
+```
+
+`google.list.withDestinationPorts` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the destination_ports field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `destination_ports` field.
+
+
+### fn withIpProtocol
+
+```ts
+withIpProtocol()
+```
+
+`google.string.withIpProtocol` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the ip_protocol field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `ip_protocol` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withPriority
+
+```ts
+withPriority()
+```
+
+`google.number.withPriority` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the priority field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `priority` field.
+
+
+### fn withSourceIpRanges
+
+```ts
+withSourceIpRanges()
+```
+
+`google.list[obj].withSourceIpRanges` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the source_ip_ranges field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSourceIpRangesMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `source_ip_ranges` field.
+
+
+### fn withSourceIpRangesMixin
+
+```ts
+withSourceIpRangesMixin()
+```
+
+`google.list[obj].withSourceIpRangesMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the source_ip_ranges field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSourceIpRanges](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `source_ip_ranges` field.
+
+
+### fn withSourcePorts
+
+```ts
+withSourcePorts()
+```
+
+`google.list.withSourcePorts` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the source_ports field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `source_ports` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj destination_ip_ranges
+
+
+
+### fn destination_ip_ranges.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_external_access_rule.destination_ip_ranges.new` constructs a new object with attributes and blocks configured for the `destination_ip_ranges`
+Terraform sub block.
+
+
+
+**Args**:
+  - `external_address` (`string`): The name of an 'ExternalAddress' resource. When `null`, the `external_address` field will be omitted from the resulting object.
+  - `ip_address_range` (`string`): An IP address range in the CIDR format. When `null`, the `ip_address_range` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `destination_ip_ranges` sub block.
+
+
+## obj source_ip_ranges
+
+
+
+### fn source_ip_ranges.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_external_access_rule.source_ip_ranges.new` constructs a new object with attributes and blocks configured for the `source_ip_ranges`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ip_address` (`string`): A single IP address. When `null`, the `ip_address` field will be omitted from the resulting object.
+  - `ip_address_range` (`string`): An IP address range in the CIDR format. When `null`, the `ip_address_range` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `source_ip_ranges` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_external_access_rule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_external_address.md b/docs/4.x/vmwareengine_external_address.md
new file mode 100644
index 00000000..b29d622c
--- /dev/null
+++ b/docs/4.x/vmwareengine_external_address.md
@@ -0,0 +1,220 @@
+---
+permalink: /vmwareengine_external_address/
+---
+
+# vmwareengine_external_address
+
+`vmwareengine_external_address` represents the `google_vmwareengine_external_address` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withInternalIp()`](#fn-withinternalip)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_external_address.new` injects a new `google_vmwareengine_external_address` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_external_address.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_external_address` using the reference:
+
+    $._ref.google_vmwareengine_external_address.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_external_address.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): User-provided description for this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `internal_ip` (`string`): The internal IP address of a workload VM.
+  - `name` (`string`): The ID of the external IP Address.
+  - `parent` (`string`): The resource name of the private cloud to create a new external address in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_address.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_external_address.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_external_address`
+Terraform resource.
+
+Unlike [google.vmwareengine_external_address.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): User-provided description for this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `internal_ip` (`string`): The internal IP address of a workload VM.
+  - `name` (`string`): The ID of the external IP Address.
+  - `parent` (`string`): The resource name of the private cloud to create a new external address in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_external_address.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_external_address` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withInternalIp
+
+```ts
+withInternalIp()
+```
+
+`google.string.withInternalIp` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the internal_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `internal_ip` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_external_address.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_network.md b/docs/4.x/vmwareengine_network.md
new file mode 100644
index 00000000..bd8faaea
--- /dev/null
+++ b/docs/4.x/vmwareengine_network.md
@@ -0,0 +1,235 @@
+---
+permalink: /vmwareengine_network/
+---
+
+# vmwareengine_network
+
+`vmwareengine_network` represents the `google_vmwareengine_network` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network.new` injects a new `google_vmwareengine_network` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_network.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_network` using the reference:
+
+    $._ref.google_vmwareengine_network.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_network.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): User-provided description for this VMware Engine network. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location where the VMwareEngineNetwork should reside.
+  - `name` (`string`): The ID of the VMwareEngineNetwork.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): VMware Engine network type. Possible values: ["LEGACY", "STANDARD"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_network.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network`
+Terraform resource.
+
+Unlike [google.vmwareengine_network.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): User-provided description for this VMware Engine network. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location where the VMwareEngineNetwork should reside.
+  - `name` (`string`): The ID of the VMwareEngineNetwork.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): VMware Engine network type. Possible values: ["LEGACY", "STANDARD"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_network` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_network_peering.md b/docs/4.x/vmwareengine_network_peering.md
new file mode 100644
index 00000000..a717550c
--- /dev/null
+++ b/docs/4.x/vmwareengine_network_peering.md
@@ -0,0 +1,336 @@
+---
+permalink: /vmwareengine_network_peering/
+---
+
+# vmwareengine_network_peering
+
+`vmwareengine_network_peering` represents the `google_vmwareengine_network_peering` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withExportCustomRoutes()`](#fn-withexportcustomroutes)
+* [`fn withExportCustomRoutesWithPublicIp()`](#fn-withexportcustomrouteswithpublicip)
+* [`fn withImportCustomRoutes()`](#fn-withimportcustomroutes)
+* [`fn withImportCustomRoutesWithPublicIp()`](#fn-withimportcustomrouteswithpublicip)
+* [`fn withName()`](#fn-withname)
+* [`fn withPeerNetwork()`](#fn-withpeernetwork)
+* [`fn withPeerNetworkType()`](#fn-withpeernetworktype)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVmwareEngineNetwork()`](#fn-withvmwareenginenetwork)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network_peering.new` injects a new `google_vmwareengine_network_peering` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_network_peering.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_network_peering` using the reference:
+
+    $._ref.google_vmwareengine_network_peering.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_network_peering.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): User-provided description for this network peering. When `null`, the `description` field will be omitted from the resulting object.
+  - `export_custom_routes` (`bool`): True if custom routes are exported to the peered network; false otherwise. When `null`, the `export_custom_routes` field will be omitted from the resulting object.
+  - `export_custom_routes_with_public_ip` (`bool`): True if all subnet routes with a public IP address range are exported; false otherwise. When `null`, the `export_custom_routes_with_public_ip` field will be omitted from the resulting object.
+  - `import_custom_routes` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes` field will be omitted from the resulting object.
+  - `import_custom_routes_with_public_ip` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes_with_public_ip` field will be omitted from the resulting object.
+  - `name` (`string`): The ID of the Network Peering.
+  - `peer_network` (`string`): The relative resource name of the network to peer with a standard VMware Engine network.
+The provided network can be a consumer VPC network or another standard VMware Engine network.
+  - `peer_network_type` (`string`): The type of the network to peer with the VMware Engine network. Possible values: ["STANDARD", "VMWARE_ENGINE_NETWORK", "PRIVATE_SERVICES_ACCESS", "NETAPP_CLOUD_VOLUMES", "THIRD_PARTY_SERVICE", "DELL_POWERSCALE"]
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:
+projects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}
+can either be a project number or a project ID.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_peering.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_network_peering.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_peering`
+Terraform resource.
+
+Unlike [google.vmwareengine_network_peering.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): User-provided description for this network peering. When `null`, the `description` field will be omitted from the resulting object.
+  - `export_custom_routes` (`bool`): True if custom routes are exported to the peered network; false otherwise. When `null`, the `export_custom_routes` field will be omitted from the resulting object.
+  - `export_custom_routes_with_public_ip` (`bool`): True if all subnet routes with a public IP address range are exported; false otherwise. When `null`, the `export_custom_routes_with_public_ip` field will be omitted from the resulting object.
+  - `import_custom_routes` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes` field will be omitted from the resulting object.
+  - `import_custom_routes_with_public_ip` (`bool`): True if custom routes are imported from the peered network; false otherwise. When `null`, the `import_custom_routes_with_public_ip` field will be omitted from the resulting object.
+  - `name` (`string`): The ID of the Network Peering.
+  - `peer_network` (`string`): The relative resource name of the network to peer with a standard VMware Engine network.
+The provided network can be a consumer VPC network or another standard VMware Engine network.
+  - `peer_network_type` (`string`): The type of the network to peer with the VMware Engine network. Possible values: ["STANDARD", "VMWARE_ENGINE_NETWORK", "PRIVATE_SERVICES_ACCESS", "NETAPP_CLOUD_VOLUMES", "THIRD_PARTY_SERVICE", "DELL_POWERSCALE"]
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:
+projects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}
+can either be a project number or a project ID.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_peering.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_network_peering` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withExportCustomRoutes
+
+```ts
+withExportCustomRoutes()
+```
+
+`google.bool.withExportCustomRoutes` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the export_custom_routes field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `export_custom_routes` field.
+
+
+### fn withExportCustomRoutesWithPublicIp
+
+```ts
+withExportCustomRoutesWithPublicIp()
+```
+
+`google.bool.withExportCustomRoutesWithPublicIp` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the export_custom_routes_with_public_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `export_custom_routes_with_public_ip` field.
+
+
+### fn withImportCustomRoutes
+
+```ts
+withImportCustomRoutes()
+```
+
+`google.bool.withImportCustomRoutes` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the import_custom_routes field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `import_custom_routes` field.
+
+
+### fn withImportCustomRoutesWithPublicIp
+
+```ts
+withImportCustomRoutesWithPublicIp()
+```
+
+`google.bool.withImportCustomRoutesWithPublicIp` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the import_custom_routes_with_public_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `import_custom_routes_with_public_ip` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withPeerNetwork
+
+```ts
+withPeerNetwork()
+```
+
+`google.string.withPeerNetwork` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the peer_network field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `peer_network` field.
+
+
+### fn withPeerNetworkType
+
+```ts
+withPeerNetworkType()
+```
+
+`google.string.withPeerNetworkType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the peer_network_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `peer_network_type` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVmwareEngineNetwork
+
+```ts
+withVmwareEngineNetwork()
+```
+
+`google.string.withVmwareEngineNetwork` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the vmware_engine_network field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `vmware_engine_network` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network_peering.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_network_policy.md b/docs/4.x/vmwareengine_network_policy.md
new file mode 100644
index 00000000..ec83c978
--- /dev/null
+++ b/docs/4.x/vmwareengine_network_policy.md
@@ -0,0 +1,400 @@
+---
+permalink: /vmwareengine_network_policy/
+---
+
+# vmwareengine_network_policy
+
+`vmwareengine_network_policy` represents the `google_vmwareengine_network_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withEdgeServicesCidr()`](#fn-withedgeservicescidr)
+* [`fn withExternalIp()`](#fn-withexternalip)
+* [`fn withExternalIpMixin()`](#fn-withexternalipmixin)
+* [`fn withInternetAccess()`](#fn-withinternetaccess)
+* [`fn withInternetAccessMixin()`](#fn-withinternetaccessmixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVmwareEngineNetwork()`](#fn-withvmwareenginenetwork)
+* [`obj external_ip`](#obj-external_ip)
+  * [`fn new()`](#fn-external_ipnew)
+* [`obj internet_access`](#obj-internet_access)
+  * [`fn new()`](#fn-internet_accessnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network_policy.new` injects a new `google_vmwareengine_network_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_network_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_network_policy` using the reference:
+
+    $._ref.google_vmwareengine_network_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_network_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): User-provided description for this network policy. When `null`, the `description` field will be omitted from the resulting object.
+  - `edge_services_cidr` (`string`): IP address range in CIDR notation used to create internet access and external IP access.
+An RFC 1918 CIDR block, with a "/26" prefix, is required. The range cannot overlap with any
+prefixes either in the consumer VPC network or in use by the private clouds attached to that VPC network.
+  - `location` (`string`): The resource name of the location (region) to create the new network policy in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-central1
+  - `name` (`string`): The ID of the Network Policy.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:
+projects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}
+can either be a project number or a project ID.
+  - `external_ip` (`list[obj]`): Network service that allows External IP addresses to be assigned to VMware workloads.
+This service can only be enabled when internetAccess is also enabled. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.external_ip.new](#fn-external_ipnew) constructor.
+  - `internet_access` (`list[obj]`): Network service that allows VMware workloads to access the internet. When `null`, the `internet_access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.internet_access.new](#fn-internet_accessnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_network_policy.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_network_policy`
+Terraform resource.
+
+Unlike [google.vmwareengine_network_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): User-provided description for this network policy. When `null`, the `description` field will be omitted from the resulting object.
+  - `edge_services_cidr` (`string`): IP address range in CIDR notation used to create internet access and external IP access.
+An RFC 1918 CIDR block, with a "/26" prefix, is required. The range cannot overlap with any
+prefixes either in the consumer VPC network or in use by the private clouds attached to that VPC network.
+  - `location` (`string`): The resource name of the location (region) to create the new network policy in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-central1
+  - `name` (`string`): The ID of the Network Policy.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network. Specify the name in the following form:
+projects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId} where {project}
+can either be a project number or a project ID.
+  - `external_ip` (`list[obj]`): Network service that allows External IP addresses to be assigned to VMware workloads.
+This service can only be enabled when internetAccess is also enabled. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.external_ip.new](#fn-external_ipnew) constructor.
+  - `internet_access` (`list[obj]`): Network service that allows VMware workloads to access the internet. When `null`, the `internet_access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.internet_access.new](#fn-internet_accessnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_network_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_network_policy` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withEdgeServicesCidr
+
+```ts
+withEdgeServicesCidr()
+```
+
+`google.string.withEdgeServicesCidr` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the edge_services_cidr field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `edge_services_cidr` field.
+
+
+### fn withExternalIp
+
+```ts
+withExternalIp()
+```
+
+`google.list[obj].withExternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the external_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withExternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `external_ip` field.
+
+
+### fn withExternalIpMixin
+
+```ts
+withExternalIpMixin()
+```
+
+`google.list[obj].withExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the external_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withExternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `external_ip` field.
+
+
+### fn withInternetAccess
+
+```ts
+withInternetAccess()
+```
+
+`google.list[obj].withInternetAccess` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the internet_access field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withInternetAccessMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `internet_access` field.
+
+
+### fn withInternetAccessMixin
+
+```ts
+withInternetAccessMixin()
+```
+
+`google.list[obj].withInternetAccessMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the internet_access field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withInternetAccess](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `internet_access` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVmwareEngineNetwork
+
+```ts
+withVmwareEngineNetwork()
+```
+
+`google.string.withVmwareEngineNetwork` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the vmware_engine_network field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `vmware_engine_network` field.
+
+
+## obj external_ip
+
+
+
+### fn external_ip.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network_policy.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): True if the service is enabled; false otherwise. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `external_ip` sub block.
+
+
+## obj internet_access
+
+
+
+### fn internet_access.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network_policy.internet_access.new` constructs a new object with attributes and blocks configured for the `internet_access`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): True if the service is enabled; false otherwise. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `internet_access` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_network_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_private_cloud.md b/docs/4.x/vmwareengine_private_cloud.md
new file mode 100644
index 00000000..1a412557
--- /dev/null
+++ b/docs/4.x/vmwareengine_private_cloud.md
@@ -0,0 +1,407 @@
+---
+permalink: /vmwareengine_private_cloud/
+---
+
+# vmwareengine_private_cloud
+
+`vmwareengine_private_cloud` represents the `google_vmwareengine_private_cloud` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withManagementCluster()`](#fn-withmanagementcluster)
+* [`fn withManagementClusterMixin()`](#fn-withmanagementclustermixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
+* [`obj management_cluster`](#obj-management_cluster)
+  * [`fn new()`](#fn-management_clusternew)
+  * [`obj management_cluster.node_type_configs`](#obj-management_clusternode_type_configs)
+    * [`fn new()`](#fn-management_clusternode_type_configsnew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_private_cloud.new` injects a new `google_vmwareengine_private_cloud` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_private_cloud.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_private_cloud` using the reference:
+
+    $._ref.google_vmwareengine_private_cloud.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_private_cloud.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): User-provided description for this private cloud. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location where the PrivateCloud should reside.
+  - `name` (`string`): The ID of the PrivateCloud.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): Initial type of the private cloud. Possible values: ["STANDARD", "TIME_LIMITED"] When `null`, the `type` field will be omitted from the resulting object.
+  - `management_cluster` (`list[obj]`): The management cluster for this private cloud. This used for creating and managing the default cluster. When `null`, the `management_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.management_cluster.new](#fn-management_clusternew) constructor.
+  - `network_config` (`list[obj]`): Network configuration in the consumer project with which the peering has to be done. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.network_config.new](#fn-network_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_private_cloud.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_private_cloud`
+Terraform resource.
+
+Unlike [google.vmwareengine_private_cloud.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): User-provided description for this private cloud. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location where the PrivateCloud should reside.
+  - `name` (`string`): The ID of the PrivateCloud.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): Initial type of the private cloud. Possible values: ["STANDARD", "TIME_LIMITED"] When `null`, the `type` field will be omitted from the resulting object.
+  - `management_cluster` (`list[obj]`): The management cluster for this private cloud. This used for creating and managing the default cluster. When `null`, the `management_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.management_cluster.new](#fn-management_clusternew) constructor.
+  - `network_config` (`list[obj]`): Network configuration in the consumer project with which the peering has to be done. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.network_config.new](#fn-network_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_private_cloud` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withManagementCluster
+
+```ts
+withManagementCluster()
+```
+
+`google.list[obj].withManagementCluster` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the management_cluster field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withManagementClusterMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `management_cluster` field.
+
+
+### fn withManagementClusterMixin
+
+```ts
+withManagementClusterMixin()
+```
+
+`google.list[obj].withManagementClusterMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the management_cluster field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withManagementCluster](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `management_cluster` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
+## obj management_cluster
+
+
+
+### fn management_cluster.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_private_cloud.management_cluster.new` constructs a new object with attributes and blocks configured for the `management_cluster`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cluster_id` (`string`): The user-provided identifier of the new Cluster. The identifier must meet the following requirements:
+  * Only contains 1-63 alphanumeric characters and hyphens
+  * Begins with an alphabetical character
+  * Ends with a non-hyphen character
+  * Not formatted as a UUID
+  * Complies with RFC 1034 (https://datatracker.ietf.org/doc/html/rfc1034) (section 3.5)
+  - `node_type_configs` (`list[obj]`): The map of cluster node types in this cluster,
+where the key is canonical identifier of the node type (corresponds to the NodeType). When `null`, the `node_type_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_private_cloud.management_cluster.node_type_configs.new](#fn-management_clusternode_type_configsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `management_cluster` sub block.
+
+
+## obj management_cluster.node_type_configs
+
+
+
+### fn management_cluster.node_type_configs.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_private_cloud.management_cluster.node_type_configs.new` constructs a new object with attributes and blocks configured for the `node_type_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `custom_core_count` (`number`): Customized number of cores available to each node of the type.
+This number must always be one of 'nodeType.availableCustomCoreCounts'.
+If zero is provided max value from 'nodeType.availableCustomCoreCounts' will be used.
+This cannot be changed once the PrivateCloud is created. When `null`, the `custom_core_count` field will be omitted from the resulting object.
+  - `node_count` (`number`): The number of nodes of this type in the cluster.
+  - `node_type_id` (`string`): Set the `node_type_id` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_type_configs` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_private_cloud.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `management_cidr` (`string`): Management CIDR used by VMware management appliances.
+  - `vmware_engine_network` (`string`): The relative resource name of the VMware Engine network attached to the private cloud.
+Specify the name in the following form: projects/{project}/locations/{location}/vmwareEngineNetworks/{vmwareEngineNetworkId}
+where {project} can either be a project number or a project ID. When `null`, the `vmware_engine_network` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_private_cloud.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/vmwareengine_subnet.md b/docs/4.x/vmwareengine_subnet.md
new file mode 100644
index 00000000..6397bd23
--- /dev/null
+++ b/docs/4.x/vmwareengine_subnet.md
@@ -0,0 +1,203 @@
+---
+permalink: /vmwareengine_subnet/
+---
+
+# vmwareengine_subnet
+
+`vmwareengine_subnet` represents the `google_vmwareengine_subnet` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withIpCidrRange()`](#fn-withipcidrrange)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_subnet.new` injects a new `google_vmwareengine_subnet` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.vmwareengine_subnet.new('some_id')
+
+You can get the reference to the `id` field of the created `google.vmwareengine_subnet` using the reference:
+
+    $._ref.google_vmwareengine_subnet.some_id.get('id')
+
+This is the same as directly entering `"${ google_vmwareengine_subnet.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `ip_cidr_range` (`string`): The IP address range of the subnet in CIDR format.
+  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of "service-n",
+where n ranges from 1 to 5.
+  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_subnet.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.vmwareengine_subnet.newAttrs` constructs a new object with attributes and blocks configured for the `vmwareengine_subnet`
+Terraform resource.
+
+Unlike [google.vmwareengine_subnet.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `ip_cidr_range` (`string`): The IP address range of the subnet in CIDR format.
+  - `name` (`string`): The ID of the subnet. For userDefined subnets, this name should be in the format of "service-n",
+where n ranges from 1 to 5.
+  - `parent` (`string`): The resource name of the private cloud to create a new subnet in.
+Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names.
+For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vmwareengine_subnet.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vmwareengine_subnet` resource into the root Terraform configuration.
+
+
+### fn withIpCidrRange
+
+```ts
+withIpCidrRange()
+```
+
+`google.string.withIpCidrRange` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the ip_cidr_range field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `ip_cidr_range` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.vmwareengine_subnet.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/workbench_instance.md b/docs/4.x/workbench_instance.md
new file mode 100644
index 00000000..cb11d018
--- /dev/null
+++ b/docs/4.x/workbench_instance.md
@@ -0,0 +1,542 @@
+---
+permalink: /workbench_instance/
+---
+
+# workbench_instance
+
+`workbench_instance` represents the `google_workbench_instance` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDisableProxyAccess()`](#fn-withdisableproxyaccess)
+* [`fn withGceSetup()`](#fn-withgcesetup)
+* [`fn withGceSetupMixin()`](#fn-withgcesetupmixin)
+* [`fn withInstanceId()`](#fn-withinstanceid)
+* [`fn withInstanceOwners()`](#fn-withinstanceowners)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj gce_setup`](#obj-gce_setup)
+  * [`fn new()`](#fn-gce_setupnew)
+  * [`obj gce_setup.accelerator_configs`](#obj-gce_setupaccelerator_configs)
+    * [`fn new()`](#fn-gce_setupaccelerator_configsnew)
+  * [`obj gce_setup.boot_disk`](#obj-gce_setupboot_disk)
+    * [`fn new()`](#fn-gce_setupboot_disknew)
+  * [`obj gce_setup.data_disks`](#obj-gce_setupdata_disks)
+    * [`fn new()`](#fn-gce_setupdata_disksnew)
+  * [`obj gce_setup.network_interfaces`](#obj-gce_setupnetwork_interfaces)
+    * [`fn new()`](#fn-gce_setupnetwork_interfacesnew)
+  * [`obj gce_setup.service_accounts`](#obj-gce_setupservice_accounts)
+    * [`fn new()`](#fn-gce_setupservice_accountsnew)
+  * [`obj gce_setup.vm_image`](#obj-gce_setupvm_image)
+    * [`fn new()`](#fn-gce_setupvm_imagenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.new` injects a new `google_workbench_instance` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.workbench_instance.new('some_id')
+
+You can get the reference to the `id` field of the created `google.workbench_instance` using the reference:
+
+    $._ref.google_workbench_instance.some_id.get('id')
+
+This is the same as directly entering `"${ google_workbench_instance.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `disable_proxy_access` (`bool`): Optional. If true, the workbench instance will not register with the proxy. When `null`, the `disable_proxy_access` field will be omitted from the resulting object.
+  - `instance_id` (`string`): Required. User-defined unique ID of this instance. When `null`, the `instance_id` field will be omitted from the resulting object.
+  - `instance_owners` (`list`): 'Optional. Input only. The owner of this instance after creation. Format:
+'alias@example.com' Currently supports one owner only. If not specified, all of
+the service account users of your VM instance''s service account can use the instance.' When `null`, the `instance_owners` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels to apply to this instance. These can be later modified
+by the UpdateInstance method.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Part of 'parent'. See documentation of 'projectsId'.
+  - `name` (`string`): The name of this workbench instance. Format: 'projects/{project_id}/locations/{location}/instances/{instance_id}'
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `gce_setup` (`list[obj]`): The definition of how to configure a VM instance outside of Resources and Identity. When `null`, the `gce_setup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.new](#fn-gce_setupnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.workbench_instance.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance`
+Terraform resource.
+
+Unlike [google.workbench_instance.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `disable_proxy_access` (`bool`): Optional. If true, the workbench instance will not register with the proxy. When `null`, the `disable_proxy_access` field will be omitted from the resulting object.
+  - `instance_id` (`string`): Required. User-defined unique ID of this instance. When `null`, the `instance_id` field will be omitted from the resulting object.
+  - `instance_owners` (`list`): 'Optional. Input only. The owner of this instance after creation. Format:
+'alias@example.com' Currently supports one owner only. If not specified, all of
+the service account users of your VM instance''s service account can use the instance.' When `null`, the `instance_owners` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels to apply to this instance. These can be later modified
+by the UpdateInstance method.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Part of 'parent'. See documentation of 'projectsId'.
+  - `name` (`string`): The name of this workbench instance. Format: 'projects/{project_id}/locations/{location}/instances/{instance_id}'
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `gce_setup` (`list[obj]`): The definition of how to configure a VM instance outside of Resources and Identity. When `null`, the `gce_setup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.new](#fn-gce_setupnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance` resource into the root Terraform configuration.
+
+
+### fn withDisableProxyAccess
+
+```ts
+withDisableProxyAccess()
+```
+
+`google.bool.withDisableProxyAccess` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the disable_proxy_access field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `disable_proxy_access` field.
+
+
+### fn withGceSetup
+
+```ts
+withGceSetup()
+```
+
+`google.list[obj].withGceSetup` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the gce_setup field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withGceSetupMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `gce_setup` field.
+
+
+### fn withGceSetupMixin
+
+```ts
+withGceSetupMixin()
+```
+
+`google.list[obj].withGceSetupMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the gce_setup field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withGceSetup](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `gce_setup` field.
+
+
+### fn withInstanceId
+
+```ts
+withInstanceId()
+```
+
+`google.string.withInstanceId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the instance_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `instance_id` field.
+
+
+### fn withInstanceOwners
+
+```ts
+withInstanceOwners()
+```
+
+`google.list.withInstanceOwners` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the instance_owners field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `instance_owners` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj gce_setup
+
+
+
+### fn gce_setup.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.new` constructs a new object with attributes and blocks configured for the `gce_setup`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disable_public_ip` (`bool`): Optional. If true, no external IP will be assigned to this VM instance. When `null`, the `disable_public_ip` field will be omitted from the resulting object.
+  - `enable_ip_forwarding` (`bool`): Optional. Flag to enable ip forwarding or not, default false/off.
+https://cloud.google.com/vpc/docs/using-routes#canipforward When `null`, the `enable_ip_forwarding` field will be omitted from the resulting object.
+  - `machine_type` (`string`): Optional. The machine type of the VM instance. https://cloud.google.com/compute/docs/machine-resource When `null`, the `machine_type` field will be omitted from the resulting object.
+  - `metadata` (`obj`): Optional. Custom metadata to apply to this instance. When `null`, the `metadata` field will be omitted from the resulting object.
+  - `tags` (`list`): Optional. The Compute Engine tags to add to instance (see [Tagging
+instances](https://cloud.google.com/compute/docs/label-or-tag-resources#tags)). When `null`, the `tags` field will be omitted from the resulting object.
+  - `accelerator_configs` (`list[obj]`): The hardware accelerators used on this instance. If you use accelerators, make sure that your configuration has
+[enough vCPUs and memory to support the 'machine_type' you have selected](https://cloud.google.com/compute/docs/gpus/#gpus-list).
+Currently supports only one accelerator configuration. When `null`, the `accelerator_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.accelerator_configs.new](#fn-gce_setupaccelerator_configsnew) constructor.
+  - `boot_disk` (`list[obj]`): The definition of a boot disk. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.boot_disk.new](#fn-gce_setupboot_disknew) constructor.
+  - `data_disks` (`list[obj]`): Data disks attached to the VM instance. Currently supports only one data disk. When `null`, the `data_disks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.data_disks.new](#fn-gce_setupdata_disksnew) constructor.
+  - `network_interfaces` (`list[obj]`): The network interfaces for the VM. Supports only one interface. When `null`, the `network_interfaces` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.network_interfaces.new](#fn-gce_setupnetwork_interfacesnew) constructor.
+  - `service_accounts` (`list[obj]`): The service account that serves as an identity for the VM instance. Currently supports only one service account. When `null`, the `service_accounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.service_accounts.new](#fn-gce_setupservice_accountsnew) constructor.
+  - `vm_image` (`list[obj]`): Definition of a custom Compute Engine virtual machine image for starting
+a workbench instance with the environment installed directly on the VM. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance.gce_setup.vm_image.new](#fn-gce_setupvm_imagenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `gce_setup` sub block.
+
+
+## obj gce_setup.accelerator_configs
+
+
+
+### fn gce_setup.accelerator_configs.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.accelerator_configs.new` constructs a new object with attributes and blocks configured for the `accelerator_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `core_count` (`string`): Optional. Count of cores of this accelerator. When `null`, the `core_count` field will be omitted from the resulting object.
+  - `type` (`string`): Optional. Type of this accelerator. Possible values: ["NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_A100", "NVIDIA_A100_80GB", "NVIDIA_L4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS"] When `null`, the `type` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `accelerator_configs` sub block.
+
+
+## obj gce_setup.boot_disk
+
+
+
+### fn gce_setup.boot_disk.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.boot_disk.new` constructs a new object with attributes and blocks configured for the `boot_disk`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disk_encryption` (`string`): Optional. Input only. Disk encryption method used on the boot and
+data disks, defaults to GMEK. Possible values: ["GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.
+  - `disk_size_gb` (`string`): Optional. The size of the boot disk in GB attached to this instance,
+up to a maximum of 64000 GB (64 TB). If not specified, this defaults to the
+recommended value of 150GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.
+  - `disk_type` (`string`): Optional. Indicates the type of the disk. Possible values: ["PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `disk_type` field will be omitted from the resulting object.
+  - `kms_key` (`string`): 'Optional. Input only. The KMS key used to encrypt the disks, only
+applicable if disk_encryption is CMEK. Format: 'projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id}'
+Learn more about using your own encryption keys.' When `null`, the `kms_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `boot_disk` sub block.
+
+
+## obj gce_setup.data_disks
+
+
+
+### fn gce_setup.data_disks.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.data_disks.new` constructs a new object with attributes and blocks configured for the `data_disks`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disk_encryption` (`string`): Optional. Input only. Disk encryption method used on the boot
+and data disks, defaults to GMEK. Possible values: ["GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.
+  - `disk_size_gb` (`string`): Optional. The size of the disk in GB attached to this VM instance,
+up to a maximum of 64000 GB (64 TB). If not specified, this defaults to
+100. When `null`, the `disk_size_gb` field will be omitted from the resulting object.
+  - `disk_type` (`string`): Optional. Input only. Indicates the type of the disk. Possible values: ["PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `disk_type` field will be omitted from the resulting object.
+  - `kms_key` (`string`): 'Optional. Input only. The KMS key used to encrypt the disks,
+only applicable if disk_encryption is CMEK. Format: 'projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id}'
+Learn more about using your own encryption keys.' When `null`, the `kms_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `data_disks` sub block.
+
+
+## obj gce_setup.network_interfaces
+
+
+
+### fn gce_setup.network_interfaces.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.network_interfaces.new` constructs a new object with attributes and blocks configured for the `network_interfaces`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Optional. The name of the VPC that this VM instance is in. When `null`, the `network` field will be omitted from the resulting object.
+  - `nic_type` (`string`): Optional. The type of vNIC to be used on this interface. This
+may be gVNIC or VirtioNet. Possible values: ["VIRTIO_NET", "GVNIC"] When `null`, the `nic_type` field will be omitted from the resulting object.
+  - `subnet` (`string`): Optional. The name of the subnet that this VM instance is in. When `null`, the `subnet` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `network_interfaces` sub block.
+
+
+## obj gce_setup.service_accounts
+
+
+
+### fn gce_setup.service_accounts.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.service_accounts.new` constructs a new object with attributes and blocks configured for the `service_accounts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `email` (`string`): Optional. Email address of the service account. When `null`, the `email` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `service_accounts` sub block.
+
+
+## obj gce_setup.vm_image
+
+
+
+### fn gce_setup.vm_image.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.gce_setup.vm_image.new` constructs a new object with attributes and blocks configured for the `vm_image`
+Terraform sub block.
+
+
+
+**Args**:
+  - `family` (`string`): Optional. Use this VM image family to find the image; the newest
+image in this family will be used. When `null`, the `family` field will be omitted from the resulting object.
+  - `name` (`string`): Optional. Use VM image name to find the image. When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): The name of the Google Cloud project that this VM image belongs to.
+Format: {project_id} When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vm_image` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.workbench_instance.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/cloudiot_registry_iam_binding.md b/docs/4.x/workbench_instance_iam_binding.md
similarity index 76%
rename from docs/4.x/cloudiot_registry_iam_binding.md
rename to docs/4.x/workbench_instance_iam_binding.md
index ce3fdbb5..8f940ec2 100644
--- a/docs/4.x/cloudiot_registry_iam_binding.md
+++ b/docs/4.x/workbench_instance_iam_binding.md
@@ -1,10 +1,10 @@
 ---
-permalink: /cloudiot_registry_iam_binding/
+permalink: /workbench_instance_iam_binding/
 ---
 
-# cloudiot_registry_iam_binding
+# workbench_instance_iam_binding
 
-`cloudiot_registry_iam_binding` represents the `google_cloudiot_registry_iam_binding` Terraform resource.
+`workbench_instance_iam_binding` represents the `google_workbench_instance_iam_binding` Terraform resource.
 
 
 
@@ -17,10 +17,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembers()`](#fn-withmembers)
 * [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 * [`fn withRole()`](#fn-withrole)
 * [`obj condition`](#obj-condition)
   * [`fn new()`](#fn-conditionnew)
@@ -34,32 +34,32 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_binding.new` injects a new `google_cloudiot_registry_iam_binding` Terraform `resource`
+`google.workbench_instance_iam_binding.new` injects a new `google_workbench_instance_iam_binding` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.cloudiot_registry_iam_binding.new('some_id')
+    google.workbench_instance_iam_binding.new('some_id')
 
-You can get the reference to the `id` field of the created `google.cloudiot_registry_iam_binding` using the reference:
+You can get the reference to the `id` field of the created `google.workbench_instance_iam_binding` using the reference:
 
-    $._ref.google_cloudiot_registry_iam_binding.some_id.get('id')
+    $._ref.google_workbench_instance_iam_binding.some_id.get('id')
 
-This is the same as directly entering `"${ google_cloudiot_registry_iam_binding.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_workbench_instance_iam_binding.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `members` (`list`): Set the `members` field on the resulting resource block.
   - `name` (`string`): Set the `name` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting resource block.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_binding.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -72,10 +72,10 @@ newAttrs()
 ```
 
 
-`google.cloudiot_registry_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_binding`
+`google.workbench_instance_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_binding`
 Terraform resource.
 
-Unlike [google.cloudiot_registry_iam_binding.new](#fn-new), this function will not inject the `resource`
+Unlike [google.workbench_instance_iam_binding.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -83,15 +83,15 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `members` (`list`): Set the `members` field on the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting object.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_binding.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_binding` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance_iam_binding` resource into the root Terraform configuration.
 
 
 ### fn withCondition
@@ -131,6 +131,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `condition` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembers
 
 ```ts
@@ -179,22 +195,6 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
-### fn withRegion
-
-```ts
-withRegion()
-```
-
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
-
-
 ### fn withRole
 
 ```ts
@@ -222,7 +222,7 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+`google.workbench_instance_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
 Terraform sub block.
 
 
diff --git a/docs/4.x/cloudiot_registry_iam_member.md b/docs/4.x/workbench_instance_iam_member.md
similarity index 76%
rename from docs/4.x/cloudiot_registry_iam_member.md
rename to docs/4.x/workbench_instance_iam_member.md
index d7fbf273..fb9c10bd 100644
--- a/docs/4.x/cloudiot_registry_iam_member.md
+++ b/docs/4.x/workbench_instance_iam_member.md
@@ -1,10 +1,10 @@
 ---
-permalink: /cloudiot_registry_iam_member/
+permalink: /workbench_instance_iam_member/
 ---
 
-# cloudiot_registry_iam_member
+# workbench_instance_iam_member
 
-`cloudiot_registry_iam_member` represents the `google_cloudiot_registry_iam_member` Terraform resource.
+`workbench_instance_iam_member` represents the `google_workbench_instance_iam_member` Terraform resource.
 
 
 
@@ -17,10 +17,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMember()`](#fn-withmember)
 * [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 * [`fn withRole()`](#fn-withrole)
 * [`obj condition`](#obj-condition)
   * [`fn new()`](#fn-conditionnew)
@@ -34,32 +34,32 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_member.new` injects a new `google_cloudiot_registry_iam_member` Terraform `resource`
+`google.workbench_instance_iam_member.new` injects a new `google_workbench_instance_iam_member` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.cloudiot_registry_iam_member.new('some_id')
+    google.workbench_instance_iam_member.new('some_id')
 
-You can get the reference to the `id` field of the created `google.cloudiot_registry_iam_member` using the reference:
+You can get the reference to the `id` field of the created `google.workbench_instance_iam_member` using the reference:
 
-    $._ref.google_cloudiot_registry_iam_member.some_id.get('id')
+    $._ref.google_workbench_instance_iam_member.some_id.get('id')
 
-This is the same as directly entering `"${ google_cloudiot_registry_iam_member.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_workbench_instance_iam_member.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `member` (`string`): Set the `member` field on the resulting resource block.
   - `name` (`string`): Set the `name` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting resource block.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_member.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -72,10 +72,10 @@ newAttrs()
 ```
 
 
-`google.cloudiot_registry_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_member`
+`google.workbench_instance_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_member`
 Terraform resource.
 
-Unlike [google.cloudiot_registry_iam_member.new](#fn-new), this function will not inject the `resource`
+Unlike [google.workbench_instance_iam_member.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -83,15 +83,15 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `member` (`string`): Set the `member` field on the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting object.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workbench_instance_iam_member.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_member` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance_iam_member` resource into the root Terraform configuration.
 
 
 ### fn withCondition
@@ -131,6 +131,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `condition` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMember
 
 ```ts
@@ -179,22 +195,6 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
-### fn withRegion
-
-```ts
-withRegion()
-```
-
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
-
-
 ### fn withRole
 
 ```ts
@@ -222,7 +222,7 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+`google.workbench_instance_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
 Terraform sub block.
 
 
diff --git a/docs/4.x/cloudiot_registry_iam_policy.md b/docs/4.x/workbench_instance_iam_policy.md
similarity index 68%
rename from docs/4.x/cloudiot_registry_iam_policy.md
rename to docs/4.x/workbench_instance_iam_policy.md
index 8c33fada..9713530a 100644
--- a/docs/4.x/cloudiot_registry_iam_policy.md
+++ b/docs/4.x/workbench_instance_iam_policy.md
@@ -1,10 +1,10 @@
 ---
-permalink: /cloudiot_registry_iam_policy/
+permalink: /workbench_instance_iam_policy/
 ---
 
-# cloudiot_registry_iam_policy
+# workbench_instance_iam_policy
 
-`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform resource.
+`workbench_instance_iam_policy` represents the `google_workbench_instance_iam_policy` Terraform resource.
 
 
 
@@ -15,10 +15,10 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
 * [`fn withPolicyData()`](#fn-withpolicydata)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 
 ## Fields
 
@@ -29,30 +29,30 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_policy.new` injects a new `google_cloudiot_registry_iam_policy` Terraform `resource`
+`google.workbench_instance_iam_policy.new` injects a new `google_workbench_instance_iam_policy` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.cloudiot_registry_iam_policy.new('some_id')
+    google.workbench_instance_iam_policy.new('some_id')
 
-You can get the reference to the `id` field of the created `google.cloudiot_registry_iam_policy` using the reference:
+You can get the reference to the `id` field of the created `google.workbench_instance_iam_policy` using the reference:
 
-    $._ref.google_cloudiot_registry_iam_policy.some_id.get('id')
+    $._ref.google_workbench_instance_iam_policy.some_id.get('id')
 
-This is the same as directly entering `"${ google_cloudiot_registry_iam_policy.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_workbench_instance_iam_policy.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting resource block.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -65,10 +65,10 @@ newAttrs()
 ```
 
 
-`google.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`
+`google.workbench_instance_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `workbench_instance_iam_policy`
 Terraform resource.
 
-Unlike [google.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `resource`
+Unlike [google.workbench_instance_iam_policy.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -76,13 +76,29 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_policy` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workbench_instance_iam_policy` resource into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
 
 
 ### fn withName
@@ -131,19 +147,3 @@ Terraform resource block to set or update the project field.
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
   - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRegion
-
-```ts
-withRegion()
-```
-
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
diff --git a/docs/4.x/workflows_workflow.md b/docs/4.x/workflows_workflow.md
index 52c20c9a..7e4004e6 100644
--- a/docs/4.x/workflows_workflow.md
+++ b/docs/4.x/workflows_workflow.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCallLogLevel()`](#fn-withcallloglevel)
 * [`fn withCryptoKeyName()`](#fn-withcryptokeyname)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withLabels()`](#fn-withlabels)
@@ -26,6 +27,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withSourceContents()`](#fn-withsourcecontents)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUserEnvVars()`](#fn-withuserenvvars)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -58,11 +60,18 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `call_log_level` (`string`): Describes the level of platform logging to apply to calls and call responses during
+executions of this workflow. If both the workflow and the execution specify a logging level,
+the execution level takes precedence. Possible values: ["CALL_LOG_LEVEL_UNSPECIFIED", "LOG_ALL_CALLS", "LOG_ERRORS_ONLY", "LOG_NONE"] When `null`, the `call_log_level` field will be omitted from the resulting object.
   - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.
 
 Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.
   - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.
   - `name_prefix` (`string`): Set the `name_prefix` field on the resulting resource block. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -74,7 +83,8 @@ Using - as a wildcard for the {project} or not providing one at all will infer t
 The {account} value can be the email address or the unique_id of the service account.
 If not provided, workflow will use the project's default service account.
 Modifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.
-  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.
+  - `source_contents` (`string`): Workflow code to be executed. The size limit is 128KB. When `null`, the `source_contents` field will be omitted from the resulting object.
+  - `user_env_vars` (`obj`): User-defined environment variables associated with this workflow revision. This map has a maximum length of 20. Each string can take up to 4KiB. Keys cannot be empty strings and cannot start with “GOOGLE” or “WORKFLOWS". When `null`, the `user_env_vars` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -99,11 +109,18 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `call_log_level` (`string`): Describes the level of platform logging to apply to calls and call responses during
+executions of this workflow. If both the workflow and the execution specify a logging level,
+the execution level takes precedence. Possible values: ["CALL_LOG_LEVEL_UNSPECIFIED", "LOG_ALL_CALLS", "LOG_ERRORS_ONLY", "LOG_NONE"] When `null`, the `call_log_level` field will be omitted from the resulting object.
   - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.
 
 Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.
   - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.
   - `name_prefix` (`string`): Set the `name_prefix` field on the resulting object. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -115,13 +132,30 @@ Using - as a wildcard for the {project} or not providing one at all will infer t
 The {account} value can be the email address or the unique_id of the service account.
 If not provided, workflow will use the project's default service account.
 Modifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.
-  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.
+  - `source_contents` (`string`): Workflow code to be executed. The size limit is 128KB. When `null`, the `source_contents` field will be omitted from the resulting object.
+  - `user_env_vars` (`obj`): User-defined environment variables associated with this workflow revision. This map has a maximum length of 20. Each string can take up to 4KiB. Keys cannot be empty strings and cannot start with “GOOGLE” or “WORKFLOWS". When `null`, the `user_env_vars` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workflows_workflow` resource into the root Terraform configuration.
 
 
+### fn withCallLogLevel
+
+```ts
+withCallLogLevel()
+```
+
+`google.string.withCallLogLevel` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the call_log_level field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `call_log_level` field.
+
+
 ### fn withCryptoKeyName
 
 ```ts
@@ -302,6 +336,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withUserEnvVars
+
+```ts
+withUserEnvVars()
+```
+
+`google.obj.withUserEnvVars` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the user_env_vars field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `user_env_vars` field.
+
+
 ## obj timeouts